Disable the RC4 cipher on Caddy

Why it matters

RC4 is a broken cipher that attackers can use to recover encrypted data, and it has been banned from TLS since 2015. No current browser needs it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Caddy cannot enable RC4. Its Caddyfile rejects RC4 suite names, and its defaults do not include it.
2. If the scan sees RC4, TLS is terminated by something in front of Caddy (a load balancer, a CDN or another server listening on 443). Fix the cipher setting there.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the 3DES cipher
• Offer modern AEAD ciphers
• Require forward-secret ciphers
• Retire the old TLS versions that use CBC ciphers