How to fix TLS v1.2 issues? (SSL Lab)

Question

I need to fix this problem.

Tried a lot of methods to beat this problem, but all failed.

If what you are looking for is guidance on cipher suites etc, maybe https://wiki.mozilla.org/Security/Server_Side_TLS is helpful — Håkan Lindqvist, Apr 05 '21 at 08:35
@HåkanLindqvist That is very useful. I think you should post it as an answer. — Andrew Schulman, Apr 05 '21 at 10:41
Here's what I do (works on Ubuntu, too) - https://antipaucity.com/2017/07/07/ssl-configuration-for-apache-2-4-on-centos-7-with-lets-encrypt/#.YGtDdWgpDcw — warren, Apr 05 '21 at 17:06
Don't rely on merely *one* service to check your site: https://antipaucity.com/2018/03/27/4-places-to-check-your-websites-ssl-tls-security-settings/#.YGtDZmgpDcw — warren, Apr 05 '21 at 17:06
What have you already tried? You claim to have tried things that failed - what were they? — warren, Apr 05 '21 at 17:07

score 7 · Accepted Answer · answered Apr 05 '21 at 12:15

The question is not entirely clear, but I'm assuming it boils down to guidance regarding configuration of appropriate TLS cipher suites, etc.

That is a question that is tricky to answer well as best practice continues to evolve over time, but I can point to some good resources:

Mozilla makes their own Server Side TLS configuration guidance public, accompanied with a configuration generator for many common services.
What is particularly useful here is that not only do they have very clear configuration guidance for multiple levels of legacy compatibility, they also document their rationale behind these suggested configurations.
Qualys does not only provide their quite popular SSL Labs Server Test (which the question appears to have a screenshot from), but also documentation with TLS Deployment Best Practices.

I would say that the Qualys document goes broader with overall deployment considerations, while the Mozilla document is focused specifically on detailed configuration considerations. Both are worthwhile and complement each other, although I get the impression that the Mozilla guide is more directly aimed at what you are asking for.

How to fix TLS v1.2 issues? (SSL Lab)

1 Answers1