title: Apache SSL: "an obsolete key exchange (RSA)"
body: <p>I have a site <a href="https://warsoftheheroes.eu/" rel="nofollow noreferrer">https://warsoftheheroes.eu/</a> which is hosted using Apache with SSL with Let's Encrypt certyficate. In Chrome/Chromium browser in developer tools -> security I see this message:</p>
  
  <pre><code>Obsolete Connection Settings
  
  The connection to this site uses a strong protocol (TLS 1.2), an obsolete key exchange (RSA), and a strong cipher (AES_128_GCM).
  </code></pre>
  
  <p>and here is my Apache SSL configuration:</p>
  
  <pre><code>&lt;IfDefine SSL&gt;
  &lt;IfDefine SSL_DEFAULT_VHOST&gt;
  &lt;IfModule ssl_module&gt;
  Listen 443
  
  &lt;VirtualHost _default_:443&gt;
      ServerName localhost
      Include /etc/apache2/vhosts.d/default_vhost.include
      ErrorLog /var/log/apache2/ssl_error_log
      &lt;IfModule log_config_module&gt;
              TransferLog /var/log/apache2/ssl_access_log
      &lt;/IfModule&gt;
      SSLEngine on
      SSLProtocol ALL -SSLv2 -SSLv3
      SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!RC4:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK
      SSLHonorCipherOrder On
      SSLCertificateFile /home/wof/ssl/fullchain1.pem
      SSLCertificateKeyFile /home/wof/ssl/privkey1.pem
      &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
              SSLOptions +StdEnvVars
      &lt;/FilesMatch&gt;
      &lt;Directory "/var/www/localhost/cgi-bin"&gt;
              SSLOptions +StdEnvVars
      &lt;/Directory&gt;
      &lt;IfModule setenvif_module&gt;
              BrowserMatch ".*MSIE.*" \
                      nokeepalive ssl-unclean-shutdown \
                      downgrade-1.0 force-response-1.0
      &lt;/IfModule&gt;
      &lt;IfModule log_config_module&gt;
              CustomLog /var/log/apache2/ssl_request_log \
                      "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
      &lt;/IfModule&gt;
  &lt;/VirtualHost&gt;
  &lt;/IfModule&gt;
  &lt;/IfDefine&gt;
  &lt;/IfDefine&gt;
  
  # vim: ts=4 filetype=apache
  </code></pre>
  
  <p>What should I change in this config file to get rid of this obsolete key exchange?</p>