Qualys SSL Labs Weak or insecure signature

[rugk]

@Spork_Schivago

As you probably know, that R denotes a reference browser or client, with which we expect better effective security.

I think what's that is saying is it connected using a certain cipher but maybe my server should have provided a better cipher.

Yes, that's what it says, but "except better security" just means this browser should be able to use a good cipher and if this browser fails to do so, there is something wrong with your config. So I think these browsers are just the "reference browsers" you should support.

As for your example the cipher is all right.

@Spork_Schivago

From what I've been reading, I'd have to throw out the 128-bit and maybe even the 256-bit elliptic curve for my ECDHE suites and use just the 384-bit ones.

No, better don't do this. 128bit has some advantages (excluding performance) in some cases.

@Spork_Schivago

where I could get a good list to use.

I'd always recommend Mozilla's config generator:
https://mozilla.github.io/server-side-tls/ssl-config-generator/

There they also state the oldest clients, which are supported with the different configurations.

@The_Decryptor

(Like it doesn't consider GCM to be a stronger mode than CBC, so can rank CBC suites above GCM ones, which is plain wrong)

The rank is usually just determined by the server AFAIK...

@Spork_Schivago

Can you recommend some other sites or tools that might be of interest for the SSL tests or any other tests I might want to run?

See this:

List of SSL/TLS related tools and tests you use?

T…