# TLS weak cipher suite negotiation: server allows export-grade ciphers enabling downgrade attack

- **ID:** `security/tls-weak-cipher-downgrade`
- **Domain:** security
- **Category:** protocol_error
- **Error Code:** `SSL_WEAK_CIPHER`
- **Verification:** ai_generated
- **Fix Rate:** 88%

## Root Cause

The TLS server supports deprecated cipher suites (e.g., EXPORT, DES, RC4) or allows protocol downgrade to TLS 1.0/1.1, enabling man-in-the-middle attackers to force weak encryption.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OpenSSL 1.1.1 | active | — | — |
| nginx 1.20.0 | active | — | — |
| Apache httpd 2.4.48 | active | — | — |

## Workarounds

1. **Disable all weak cipher suites and enforce TLS 1.2+ only. Example nginx config: ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...'; ssl_prefer_server_ciphers on;** (95% success)
   ```
   Disable all weak cipher suites and enforce TLS 1.2+ only. Example nginx config: ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...'; ssl_prefer_server_ciphers on;
   ```
2. **Use a tool like Mozilla SSL Configuration Generator to produce a hardened configuration, then test with sslyze or testssl.sh** (90% success)
   ```
   Use a tool like Mozilla SSL Configuration Generator to produce a hardened configuration, then test with sslyze or testssl.sh
   ```
3. **Enable TLS 1.3 support which mandates strong ciphers and provides downgrade protection via the ServerHello random value** (85% success)
   ```
   Enable TLS 1.3 support which mandates strong ciphers and provides downgrade protection via the ServerHello random value
   ```

## Dead Ends

- **** — Weak ciphers like RC4 and DES are still supported in TLS 1.1 and 1.2, allowing downgrade. (70% fail)
- **** — Does not fix the server configuration; attackers can use different IPs or proxies. (90% fail)
- **** — HSTS only protects against SSL stripping, not cipher suite downgrade within the same protocol. (60% fail)