# Absolète encryption method **URL:** \ **Category:** Server\ **Created:** [February 16, 2016, 9:12am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913 "2016-02-16T09:12:33Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![HBG404](https://avatars.discourse-cdn.com/v4/letter/h/b5e925/32.png) [@HBG404](https://community.letsencrypt.org/u/HBG404)\ **Post date:** [February 16, 2016, 9:12am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/1 "2016-02-16T09:12:33Z")
Hi, I encountrered this issue ( in french which i transtated it ot english ) within my address bar =========================== Your connection is encrypted using an encryption method absolète. The connection uses TLS 1.2 The connexion is encrypted using AES\_256\_CBC with HMAC-SHA1 to as authentication of messages and ECDHE\_RSA for key exchange method ================== So what can i do please ? Kind regards ---
**Author:** ![weppos](https://avatars.discourse-cdn.com/v4/letter/w/dc4da7/32.png) [@weppos](https://community.letsencrypt.org/u/weppos)\ **Post date:** [February 16, 2016, 9:39am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/2 "2016-02-16T09:39:07Z")
This issue depends on the webserver configuration. Depending on the web server you use, you should configure it so that it uses an appropriate modern cipher and protocol version. You can see the common recommended settings here [https://cipherli.st/](https://cipherli.st/) This issue doesn’t depend on the SSL/TLS certificate itself. ---
**Author:** ![HBG404](https://avatars.discourse-cdn.com/v4/letter/h/b5e925/32.png) [@HBG404](https://community.letsencrypt.org/u/HBG404)\ **Post date:** [February 16, 2016, 9:51am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/3 "2016-02-16T09:51:10Z")
> [@weppos](#): > > webserver configuration And so What can i do exactly ? Where can i change the configurations I'm a web developer and i don't have a large knowledge in system configuration Apache Server Version : 2.4.10 OpenSSL Version : 1.0.1k Thanks ---
**Author:** ![weppos](https://avatars.discourse-cdn.com/v4/letter/w/dc4da7/32.png) [@weppos](https://community.letsencrypt.org/u/weppos)\ **Post date:** [February 16, 2016, 9:54am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/4 "2016-02-16T09:54:55Z")
Do you have administrative access to your Apache configuration file? ---
**Author:** ![ecdsa-chacha20](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ecdsa-chacha20/32/955_2.png) [@ecdsa-chacha20](https://community.letsencrypt.org/u/ecdsa-chacha20)\ **Post date:** [February 16, 2016, 10:19am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/5 "2016-02-16T10:19:44Z")
A total of 16 CVEs have been fixed in OpenSSL 1.0.1 since 1.0.1k. [https://www.openssl.org/news/openssl-1.0.1-notes.html](https://www.openssl.org/news/openssl-1.0.1-notes.html) A total of 8 CVEs have been fixed in Apache 2.4 since 2.4.10. [https://httpd.apache.org/security/vulnerabilities\_24.html](https://httpd.apache.org/security/vulnerabilities_24.html) Your cipher list may not be your only problem. ---
**Author:** ![HBG404](https://avatars.discourse-cdn.com/v4/letter/h/b5e925/32.png) [@HBG404](https://community.letsencrypt.org/u/HBG404)\ **Post date:** [February 16, 2016, 10:23am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/6 "2016-02-16T10:23:27Z")
yes i have administrative access to your Apache configuration file 🙂 ---
**Author:** ![HBG404](https://avatars.discourse-cdn.com/v4/letter/h/b5e925/32.png) [@HBG404](https://community.letsencrypt.org/u/HBG404)\ **Post date:** [February 16, 2016, 10:24am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/7 "2016-02-16T10:24:41Z")
So what’s the other problems ?? ---
**Author:** ![ecdsa-chacha20](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ecdsa-chacha20/32/955_2.png) [@ecdsa-chacha20](https://community.letsencrypt.org/u/ecdsa-chacha20)\ **Post date:** [February 16, 2016, 10:29am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/8 "2016-02-16T10:29:01Z")
Well … system updates. ---
**Author:** ![weppos](https://avatars.discourse-cdn.com/v4/letter/w/dc4da7/32.png) [@weppos](https://community.letsencrypt.org/u/weppos)\ **Post date:** [February 16, 2016, 10:35am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/9 "2016-02-16T10:35:33Z")
Then review the configuration list for apache posted at [https://cipherli.st/](https://cipherli.st/) and apply the configurations that make sense for you. Specifically, the first 3 lines are the lines that will help to solve the issue. ```auto SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On ``` You can test your SSL setup using [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/) A word of warning: take the time to read and document yourself on each specific configuration, do not blindly copy and paste them as they can affect your current and future setup for the site and how users will connect to your site. Even if, for your own words, _I’m a web developer and i don’t have a large knowledge in system configuration_, this is not the kind of question where you can get a “copy-paste” solution. ---
**Author:** ![HBG404](https://avatars.discourse-cdn.com/v4/letter/h/b5e925/32.png) [@HBG404](https://community.letsencrypt.org/u/HBG404)\ **Post date:** [February 16, 2016, 10:54am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/11 "2016-02-16T10:54:16Z")
My OS is Debian so in which file can i put the above instractions ? and where is located ? ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [February 16, 2016, 11:03am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/12 "2016-02-16T11:03:17Z")
> [@ecdsa-chacha20](#): > > A total of 16 CVEs have been fixed in OpenSSL 1.0.1 since 1.0.1k. [https://www.openssl.org/news/openssl-1.0.1-notes.htmlA](https://www.openssl.org/news/openssl-1.0.1-notes.htmlA) total of 8 CVEs have been fixed in Apache 2.4 since 2.4.10. [Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project](https://httpd.apache.org/security/vulnerabilities_24.html) > > Your cipher list may not be your only problem. Hello @ecdsa-chacha20, This is really off topic but... keep in mind that the fact that your Linux distribution is using a specific version doesn't mean that this version is not being patched to solve CVE vulnerabilities. Just an example, in the link you posted to apache CVE vulnerabilities, the last CVE (mod\_lua: Crash in websockets PING handling CVE-2015-0228) has been solved in official apache 2.4.16 but Debian stable (jessie) is using apache 2.4.10, but that doesn't mean that it is vulnerable because this version is being pacthed to solve this kind of issues. Following this apache example, debian fixed it in version 2.4.10-10+deb8u4 [CVE-2015-0228](https://security-tracker.debian.org/tracker/CVE-2015-0228) Reading your comment seems like the op should raise their arms and start to run in circles 😃 Anyway, it's worth your advice to keep the system updated. Cheers, sahsanu ---
**Author:** ![came88](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/came88/32/4398_2.png) [@came88](https://community.letsencrypt.org/u/came88)\ **Post date:** [February 16, 2016, 11:09am UTC](https://community.letsencrypt.org/t/absolete-encryption-method/10913/13 "2016-02-16T11:09:15Z")
See also [https://mozilla.github.io/server-side-tls/ssl-config-generator/](https://mozilla.github.io/server-side-tls/ssl-config-generator/) You put in there your server type and version, openssl version and what kind of configuration you prefer (i.e.: do you need to support IE6/XP?) and the site give you a recommended configuration. You need to modify some files under /etc/apache2/ and then reload or restart apache, but please **read the documentation until you fully understand what you are doing**. For example if you enable HSTS by mistake and them disable it many people won’t be able to access your website anymore.