Disable the RC4 cipher on Apache

Why it matters

RC4 is a broken cipher that attackers can use to recover encrypted data, and it has been banned from TLS since 2015. No current browser needs it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Find every existing setting with grep -Rn -E 'SSLProtocol|SSLCipherSuite' /etc/apache2 /etc/httpd /etc/letsencrypt. A VirtualHost or included line overrides the global one, so change each (on Debian and Ubuntu the global line is in /etc/apache2/mods-available/ssl.conf, on RHEL-family systems in /etc/httpd/conf.d/ssl.conf).
2. Run apachectl configtest, then reload.

SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder     off

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the 3DES cipher
• Offer modern AEAD ciphers
• Require forward-secret ciphers
• Retire the old TLS versions that use CBC ciphers