Cipher suites describe cryptographic choices available during a TLS connection. SSLBoard groups flagged suites into families so that you can see both the affected endpoints and the reason for review.
Families the report flags
| Families | Why review them |
|---|---|
| NULL, anonymous, EXPORT | These can lack encryption, authentication, or adequate cryptographic strength. |
| RC4, RC2, DES, MD5 | These are obsolete cryptographic choices flagged as critical by the scoring model. |
| 3DES, IDEA, SEED | These are legacy encryption families flagged for replacement or compatibility review. |
| RSA key exchange, static DH, static ECDH | These raise forward secrecy concerns. RSA key exchange is different from an RSA certificate. |
| Finite-field DHE | SSLBoard flags this family for review of legacy configuration and parameters; its presence alone does not establish weak parameters. |
| CBC, SHA-1 | These are legacy construction or algorithm indicators. Assess the exact suite and implementation context. |
| PSK, SRP, Kerberos, DSS, GOST | These are specialized or legacy families that warrant a deliberate compatibility and policy decision. |
The scoring model marks EXPORT, NULL, anonymous, RC4, RC2, MD5, and DES families as critical. The remaining listed families are warnings. Several family labels can apply to a single suite, so family counts are not unique endpoint counts.
What a finding establishes
A listed suite means the scan reported support for that choice on the affected endpoint. It does not prove that a real visitor negotiated it, that an attacker exploited it, or that every vulnerability associated with its family applies to the server.
Use any CVE references as context for investigation. Confirm their prerequisites before treating a family-level finding as a demonstrated vulnerability. Similarly, SHA-1 in a cipher name should not be confused automatically with the certificate’s signature algorithm.
Remediate and verify
Review the exact suites with the operator of the TLS terminator and remove unnecessary legacy support while preserving required clients. Prefer a maintained configuration appropriate to your server and compatibility requirements. Retest after deployment and confirm the flagged suites are no longer observed on each affected address.
If the list is empty but TLS probing failed, you have no evidence of safe cipher support from that endpoint. Review connection errors and forward secrecy with this section.