A cipher suite is the set of cryptographic choices available for a connection. SSLBoard groups the suites it flags into families, so you see both the affected endpoints and the reason each one is worth a look.
The families and why they are flagged
| Families | Why review them |
|---|---|
| NULL, anonymous, EXPORT | Can lack encryption, authentication, or adequate strength outright |
| RC4, RC2, DES, MD5 | Obsolete cryptography. Scored as critical |
| 3DES, IDEA, SEED | Legacy encryption. Flagged for replacement or a compatibility decision |
| RSA key exchange, static DH, static ECDH | No forward secrecy. Note this is key exchange, not your certificate |
| Finite-field DHE | Flagged so you review the legacy configuration and its parameters |
| CBC, SHA-1 | Legacy construction and algorithm indicators. Judge the exact suite in context |
| PSK, SRP, Kerberos, DSS, GOST | Specialized or legacy families that deserve a deliberate policy decision |
Scored as critical: EXPORT, NULL, anonymous, RC4, RC2, MD5, DES. Everything else on the list is a warning.
Family counts overlap. One suite can land in several families, so the counts are not unique endpoint counts. Use the endpoint list when you need a real number.
What a finding actually establishes
That the endpoint reported support for that choice. That is all, and it is enough to act on.
Four things it does not establish, in rough order of how often they get assumed:
- That a real visitor negotiated the suite, or that anybody exploited it.
- That every attack historically associated with that family applies to your server and version. Where a CVE is referenced, check its prerequisites before calling a family-level finding a demonstrated vulnerability.
- That a flagged finite-field DHE suite has weak parameters. The family is flagged so you go and look.
- That SHA-1 in a cipher suite name has anything to do with SHA-1 in your certificate’s signature algorithm. Different layer, different problem.
And the inverse trap: an empty cipher list on an endpoint whose TLS probe failed is not evidence of good ciphers. It is evidence of nothing. Check connection errors before reading a blank result as clean.
Remediate and verify
Go through the exact suites with whoever runs the TLS terminator. Drop the legacy support you do not need while keeping the clients you actually have to serve, and prefer a maintained configuration profile for your server software over a hand-assembled cipher string.
Then retest and confirm the flagged suites are gone on each affected address. Read the result alongside forward secrecy, since removing a suite can change which key exchange you end up negotiating.