I run a few small sites, and last year installed SSL certificates on each of them. Last week a visitor contacted me with a question about my SSL certificate, which prompted me to run a couple of SSL tests. One of my sites gets a grade of A from this SSL test, and another gets a grade of C. According to another SSL test, both pass without issue.
The one that gets a grade of C fails because of:
- weak Diffie-Hellman key exchange parameters.
- no support for TLS 1.2.
- server accepts RC4 cipher.
- no support for forward secrecy.
I'm scratching my head to understand the difference. My SSL certs are the same brand, same type, and from the same vendor. I installed them following the same process. The only difference between these is the webhost, but both webhosts are prominent/recognizeable companies.
How do I fix this? Regenerate my CSR & SSL certificate? Purchase a new SSL certificate? Contact support at my webhost?
Edit: Adding my server information for the server that didn't pass:
- shared hosting
- Apache 2.2.22
- OpenSSL 0.9.8