Disable the RC4 cipher
Why it matters
RC4 is a broken cipher that attackers can use to recover encrypted data, and it has been banned from TLS since 2015. No current browser needs it.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Replace any custom cipher list with a modern one made of ECDHE key exchange and AES-GCM or ChaCha20 ciphers, as in the snippets for your server.
- If you did not write a cipher list yourself, the server software is very old. Update it and its TLS library.
- Stage the change. Apply it, test with the commands below, and restore the previous configuration if a client you must support breaks.
- Confirm RC4 is refused.
bash
# lists every cipher the server accepts per protocol version; RC4 must not appear nmap --script ssl-enum-ciphers -p 443 example.com # alternative: testssl.sh --rc4 example.com
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.