---
title: "WEB-NGX-004 nginx Cipher List Includes Weak Suites"
canonical: https://openvapt.com/checks/WEB-NGX-004.html
html: https://openvapt.com/checks/WEB-NGX-004.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-NGX-004 nginx Cipher List Includes Weak Suites

ssl_ciphers includes NULL, export, DES or 3DES, RC4, MD5, anonymous or other legacy suites, or ssl_prefer_server_ciphers forces a legacy order.

- Domain: Web Apps
- Severity: High
- Control category: Cryptography and TLS
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`
- CIS Controls v8: 3.10
- NIST CSF 2.0: PR.DS-02
- CWE: CWE-327
- OWASP Top 10 2021: A02:2021
- OWASP ASVS 4.0.3: 9.1.2
- OWASP WSTG v4.2: WSTG-CRYP-01
- NIST SP 800-53 Rev. 5: SC-8, SC-13
- Benchmark topic: TLS cipher suites (topic only, no benchmark text)

## Why It Matters

Weak suites allow recorded traffic to be decrypted or sessions to be hijacked. Modern clients already prefer strong suites, so the Mozilla guidelines recommend a short explicit list and ssl_prefer_server_ciphers off.

## How It Detects

Reads every ssl_ciphers directive and flags OpenSSL tokens that name NULL, EXPORT, DES, RC4, MD5, aNULL, ADH, AECDH, PSK, SRP, IDEA, SEED or CAMELLIA suites, and bare ALL or DEFAULT. Tokens excluded with ! or - are ignored. ssl_prefer_server_ciphers on is reported as evidence only.

## How to Fix

Use the Mozilla intermediate list, for example  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;  and  ssl_prefer_server_ciphers off;

## How to Verify

```
Run the nmap ssl-enum-ciphers script against 127.0.0.1 port 443 under your own test plan; it should list only grade A suites.
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)

## References

- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)
- [Mozilla, Server Side TLS guidelines](https://wiki.mozilla.org/Security/Server_Side_TLS)
- [RFC 7525, Recommendations for Secure Use of TLS and DTLS](https://www.rfc-editor.org/rfc/rfc7525.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-NGX-004`. Read it offline: `openvapt explain WEB-NGX-004`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-NGX-004.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.