RC4 is no longer recommended, but is the best supported method as I understand it [0]. There's also the issue that the most widely available versions of openssl

RC4 is no longer recommended, but is the best supported method as I understand it [0]. There's also the issue that the most widely available versions of openssl do not support PFS or tls 1.2. You need to download and compile a newer version of openssl (rather than using packages - RHEL in particular since that's what we use), and then compile whatever web server or proxy again with the newer openssl support. [0] https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what https://community.qualys.com/blogs/securitylabs/2013/03/19/r...