1

I run a few small sites, and last year installed SSL certificates on each of them. Last week a visitor contacted me with a question about my SSL certificate, which prompted me to run a couple of SSL tests. One of my sites gets a grade of A from this SSL test, and another gets a grade of C. According to another SSL test, both pass without issue.

The one that gets a grade of C fails because of:

  • weak Diffie-Hellman key exchange parameters.
  • no support for TLS 1.2.
  • server accepts RC4 cipher.
  • no support for forward secrecy.

I'm scratching my head to understand the difference. My SSL certs are the same brand, same type, and from the same vendor. I installed them following the same process. The only difference between these is the webhost, but both webhosts are prominent/recognizeable companies.

How do I fix this? Regenerate my CSR & SSL certificate? Purchase a new SSL certificate? Contact support at my webhost?

Edit: Adding my server information for the server that didn't pass:

  • shared hosting
  • Apache 2.2.22
  • OpenSSL 0.9.8
  • Based on your question as well as the answer posted, it would be helpful if you could provide web server software details for each server. Like what version of Apache you might be using if you are indeed using Apache. – JakeGould Aug 28 '15 at 23:01
  • I updated my question to include server info. This is shared hosting so I don't have root access, but based on the answer from @Ips below I now know which questions to ask. I'm logging a support request now. – Lenwood Aug 29 '15 at 2:02
7

Those issues are related to the web server SSL configuration, not the certificate.

For example, see this issue in regards to the “Server supports RC4 Cipher.”

It is specific to Apache, but just Google this issue for your specific web server if it’s different.

Further - if you don't have access to the server config you would contact your web host and ask them to fix it.

  • Would be nice if you explained how they solve their configuration problem in detail. – Ramhound Aug 28 '15 at 23:02
  • 6
    @Ramhound You've got to be kidding. OP didn't mention who his webhosts are or what web server software they're running. How can anyone explain in detail how to solve a configuration problem with unknown vendors and software packages? – Spiff Aug 28 '15 at 23:12
  • @Spiff - So we as a community are alright with answers like this? He indicates the issue is specific to Apache, doesn't say what the issue is, the answer just feels incomplete. – Ramhound Aug 28 '15 at 23:18
  • @Ramhound He was saying the article he was referencing was specific to Apache. Since OP (Lenwood) didn't say what he was running, this Answerer (Ips) could only guess and point him at an Apache-specific resource. – Spiff Aug 28 '15 at 23:20
  • @Ramhound I just used Apache as an example. I noted that the specific solution would be different depending on the web server. I've also edited my answer and advised the OP to contact his web host if he doesn't have access to the server. – lps Aug 28 '15 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.