tls.cipher.weak

Weak Cipher Suites Supported

What we check

We inspect the cipher suites the server negotiates during the TLS handshake. Cipher suites using RC4, DES, 3DES, export-grade ciphers, or NULL encryption are classified as weak.

What this finding means

The mail server accepts connections using cipher suites with known cryptographic weaknesses. These ciphers either use broken algorithms (RC4), insufficient key lengths (DES, export), or provide no encryption at all (NULL).

Why it matters

Known broken. RC4 has practical biases exploitable in TLS; DES/3DES are vulnerable to Sweet32; export ciphers were intentionally weakened. These are not theoretical concerns.
Downgrade risk. An active network attacker can force the weakest mutually supported cipher — as long as a weak cipher is offered, it can be selected.
Compliance failure. PCI DSS, NIST SP 800-52, and BSI TR-02102-2 all prohibit these cipher suites.

How to fix

Restrict cipher suites to strong options. For Postfix:

# /etc/postfix/main.cf
smtpd_tls_ciphers = medium
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK
smtpd_tls_mandatory_ciphers = medium

Or use an explicit cipher list:

smtpd_tls_mandatory_ciphers = medium
tls_medium_cipherlist = ECDHE+AESGCM:DHE+AESGCM:ECDHE+AES:DHE+AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

Reload and verify:

postfix reload
nmap --script ssl-enum-ciphers -p 25 mail.example.com

How it's graded

Weak cipher suites carry a 15-point deduction in the TLS category. See Grading Methodology for the full scoring model.

Evidence example

Supported cipher suites include:
  TLS_RSA_WITH_RC4_128_SHA (weak — RC4)
  TLS_RSA_WITH_3DES_EDE_CBC_SHA (weak — 3DES)