tls_advanced.ciphers Reviewed July 2026

Quick fix

Remove NULL, EXPORT, RC4, DES, 3DES, MD5, and anonymous suites from every public TLS termination point.

What this finding means

SecuTest attempts a bounded candidate set with normal TLS 1.2 handshakes. It reports only suites that the server accepts and separates legacy CBC observations from conclusively weak algorithms.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, or business intent when those cannot be proven remotely.

Why it matters

Security impact Accepted NULL, EXPORT, RC4, DES, 3DES, MD5, or anonymous suites materially weaken confidentiality or authentication.

Step-by-step fix

Where to make the change

  • The public TLS termination point: CDN, load balancer, reverse proxy, ingress controller, or web server.
  • The origin server only when it terminates the externally observed TLS connection.

Remediation procedure

  1. Remove NULL, EXPORT, RC4, DES, 3DES, MD5, and anonymous suites from every public TLS termination point.
  2. Prefer authenticated AEAD suites using AES-GCM or ChaCha20-Poly1305.
  3. Retain only suites required by supported clients and document exceptions.
  4. Apply the same policy to CDN, load balancer, reverse proxy, and origin.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, or provider values shown in your SecuTest evidence.

Test TLS 1.2
openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null

Test TLS 1.3
openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null

Verify the fix

  1. Enumerate the effective configuration with an approved TLS scanner.
  2. Attempt each retired suite with openssl s_client -cipher SUITE.
  3. Confirm modern browsers and API clients still connect.
  4. Repeat the SecuTest scan.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Editing an origin configuration while a managed edge terminates TLS.
  • Using cipher names unsupported by the deployed OpenSSL version.
  • Treating every CBC suite as proof of a specific exploitable vulnerability.

Authoritative references