Disable the 3DES cipher on Apache

Why it matters

3DES uses a small block size that lets attackers recover data from long connections (the Sweet32 attack), and it is weaker than the 128-bit minimum used today. Current browsers and clients do not need it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find every existing setting with grep -Rn -E 'SSLProtocol|SSLCipherSuite' /etc/apache2 /etc/httpd /etc/letsencrypt. A VirtualHost or included line overrides the global one, so change each (on RHEL-family systems the global line is in /etc/httpd/conf.d/ssl.conf).
2. Run apachectl configtest, then reload.

SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder     off

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the RC4 cipher
• Offer modern AEAD ciphers
• Require forward-secret ciphers
• Retire the old TLS versions that use CBC ciphers