Weak encryption options are offered

SeverityMedium

ScopeWhole site

EffortMedium

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_tls_weak_ciphers

Short answer

In the deep TLS test your server accepted at least one weak cipher family (NULL or anonymous ciphers, EXPORT-grade, low-strength DES/RC2/RC4, or 3DES/IDEA), or it offered no forward-secret key exchange at all. Modern browsers rarely choose these, but they stay available to anyone who asks for them. Restrict the server to ECDHE key exchange with AES-GCM or ChaCha20-Poly1305.

Why it matters

NULL and anonymous suites provide no encryption or no authentication; EXPORT and DES can be broken outright; RC4 and 3DES fall to statistical attacks (RC4 biases, and Sweet32 against 64-bit block ciphers such as 3DES). Without forward secrecy (ECDHE or DHE key exchange), anyone who later obtains your private key can decrypt traffic they recorded earlier. Rankings are unaffected; this is about keeping recorded or downgraded connections unreadable.

How Glimana detects it

The same deep TLS test as the old-protocol check (testssl.sh, handshake only) lists the cipher families your server accepts. The check fails with medium severity if the server accepts NULL, anonymous (aNULL), EXPORT, LOW (DES, RC2, RC4) or 3DES/IDEA suites, or if it offers no forward-secret suite at all. CBC-mode suites offered alongside forward-secret ones do not fail the check on their own. While the deep test is unavailable the check shows Not running yet, and Could not be measured if the test cannot finish.

How to fix it

Watch out

Copy a complete, tested configuration (Mozilla's generator, profile Intermediate) instead of editing a cipher string by hand: one wrong token, such as a missing !, can re-enable a whole family. Removing 3DES drops only clients like Internet Explorer 8 on Windows XP; nothing in real use still depends on it.

Find the finding in Glimana. Open Security; this check is in the Certificate and HTTPS group, with the evidence from the last scan under its title. The same problem is listed under Issues › Weak encryption options are offered.
Apply the fix on your platform.

NginxApacheCloudflare

In the http block (Mozilla Intermediate style):
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
TLS 1.3 suites are all strong and are not controlled by ssl_ciphers. Reload with sudo nginx -t && sudo systemctl reload nginx.

In the global SSL configuration:
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
Then sudo apachectl configtest and reload Apache.

On proxied records (orange cloud) visitors connect to Cloudflare's edge, and its default cipher list does not include the weak families this check looks for; in our own measurements proxied sites pass. If a proxied site is still flagged, someone has customised the edge cipher list (SSL/TLS › Edge Certificates › Cipher suites, an Advanced Certificate Manager setting): set it back to the default or to the Modern profile. More often the scanned address is a DNS-only (grey cloud) record, which exposes your origin's ciphers; fix those with the Nginx or Apache settings.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

Press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes when the check passes.