We are trying to be more secure so a client can accept credit cards. The firm that inspects our vulnerabilities produced the following. I thought i had addressed this in the security section of SBS 2011 but it appears that i did not. Any, and all, detailed information on how to correct this would be so appreciated.
The SSL-based service running on this host appears to support the use of "weak" ciphers such as:
- Ciphers suites that have key-lengths of less than 128 bits.
- Ciphers suites using anonymous Diffie-Hellman algorithms (no authentication).
- Ciphers suites offering no encryption.
- Ciphers suites using pre-shared keys.
- Ciphers suites using RC4 or MD5.