---
title: "WEB-APA-006 Apache Cipher Suite Includes Weak Suites"
canonical: https://openvapt.com/checks/WEB-APA-006.html
html: https://openvapt.com/checks/WEB-APA-006.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APA-006 Apache Cipher Suite Includes Weak Suites

SSLCipherSuite includes NULL, export, DES or 3DES, RC4, MD5, anonymous or other legacy suites, or SSLHonorCipherOrder forces a legacy order.

- Domain: Web Apps
- Severity: High
- Control category: Cryptography and TLS
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`
- CIS Controls v8: 3.10
- NIST CSF 2.0: PR.DS-02
- CWE: CWE-327
- OWASP Top 10 2021: A02:2021
- OWASP ASVS 4.0.3: 9.1.2
- OWASP WSTG v4.2: WSTG-CRYP-01
- NIST SP 800-53 Rev. 5: SC-8, SC-13
- Benchmark topic: TLS cipher suites (topic only, no benchmark text)

## Why It Matters

Weak suites allow recorded traffic to be decrypted or sessions to be hijacked. The Mozilla guidelines give a short explicit list that modern clients all support.

## How It Detects

Reads every SSLCipherSuite directive and flags OpenSSL tokens naming NULL, EXPORT, DES, RC4, MD5, aNULL, ADH, AECDH, PSK, SRP, IDEA, SEED or CAMELLIA, and bare ALL or DEFAULT. Tokens excluded with ! or - are ignored. SSLHonorCipherOrder on is reported as evidence.

## How to Fix

Use the Mozilla intermediate list for SSLCipherSuite and set  SSLHonorCipherOrder off , as the Mozilla SSL Configuration Generator produces for Apache.

## How to Verify

```
Run the nmap ssl-enum-ciphers script against 127.0.0.1 port 443 under your own test plan; it should list only grade A suites.
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)

## References

- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)
- [Apache HTTP Server, SSLCipherSuite directive](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslciphersuite)
- [RFC 7525, Recommendations for Secure Use of TLS and DTLS](https://www.rfc-editor.org/rfc/rfc7525.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-APA-006`. Read it offline: `openvapt explain WEB-APA-006`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APA-006.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.