Disable the 3DES cipher on Caddy

Why it matters

3DES uses a small block size that lets attackers recover data from long connections (the Sweet32 attack), and it is weaker than the 128-bit minimum used today. Current browsers and clients do not need it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Caddy cannot enable 3DES. Its Caddyfile rejects 3DES suite names, and its defaults do not include it.
2. If the scan sees 3DES, TLS is terminated by something in front of Caddy (a load balancer, a CDN or another server listening on 443). Fix the cipher setting there.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the RC4 cipher
• Offer modern AEAD ciphers
• Require forward-secret ciphers
• Retire the old TLS versions that use CBC ciphers