Disable the 3DES cipher on Cloudflare

Why it matters

3DES uses a small block size that lets attackers recover data from long connections (the Sweet32 attack), and it is weaker than the 128-bit minimum used today. Current browsers and clients do not need it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Cloudflare's default edge cipher list still includes 3DES and suites with RSA key exchange. Changing it, for the zone or for one hostname, needs Advanced Certificate Manager (zone level in the dashboard or API, hostname level in the API only).
2. After any change, test with the nmap command from the generic entry, and note the previous setting so you can revert it.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the RC4 cipher
• Offer modern AEAD ciphers
• Require forward-secret ciphers
• Retire the old TLS versions that use CBC ciphers