# Qualys SSL Labs and haproxy (solved)

**URL:** <https://discourse.haproxy.org/t/qualys-ssl-labs-and-haproxy-solved/1077>\
**Category:** Help!\
**Created:** [March 14, 2017, 10:07am UTC](https://discourse.haproxy.org/t/qualys-ssl-labs-and-haproxy-solved/1077 "2017-03-14T10:07:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mr.proxy](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@mr.proxy](https://discourse.haproxy.org/u/mr.proxy)\
**Post date:** [March 14, 2017, 10:07am UTC](https://discourse.haproxy.org/t/qualys-ssl-labs-and-haproxy-solved/1077/1 "2017-03-14T10:07:18Z")

</div>

Hello,

We have two haproxy servers (redundancy) accepting HTTPS. Just tested the SSL security by using [https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/). We get a B due to the following issues:

“This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.” More info at [https://weakdh.org/](https://weakdh.org/)

“This server accepts RC4 cipher, but only with older browsers. Grade capped to B.” More info at [https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what](https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what)

My question is: What do we need to do to fix this issues so that we can get an A?

Please note that we have tried what the suggestions on [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html), but this broke our haproxy’s.

haproxy -v say:  
HA-Proxy version 1.5.8 2014/10/31  
Copyright 2000-2014 Willy Tarreau [w@1wt.eu](mailto:w@1wt.eu)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 14, 2017, 2:05pm UTC](https://discourse.haproxy.org/t/qualys-ssl-labs-and-haproxy-solved/1077/2 "2017-03-14T14:05:01Z")

</div>

Well it also depends on your OpenSSL version. What does haproxy -vv say?

You can find a lot of informations here:  
[https://wiki.mozilla.org/Security/Server\_Side\_TLS](https://wiki.mozilla.org/Security/Server_Side_TLS)

And an actual config generator here:  
[https://mozilla.github.io/server-side-tls/ssl-config-generator/](https://mozilla.github.io/server-side-tls/ssl-config-generator/)

What does “broke our haproxy” mean?

---

<div class="post-metadata">

**Author:** ![mr.proxy](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@mr.proxy](https://discourse.haproxy.org/u/mr.proxy)\
**Post date:** [March 14, 2017, 2:23pm UTC](https://discourse.haproxy.org/t/qualys-ssl-labs-and-haproxy-solved/1077/3 "2017-03-14T14:23:42Z")

</div>

First, our ISP found some solutions to this just a few minutes ago, so now we have grade A 🙂

By “broken our haproxy” -\> it simply stopped working so that the site was not reachable anymore. The browser did not get any response at all.

Thanks for the links.