RSA key exchange is obsolete. Enable an ECDHE-based cipher suite

Question

If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is obsolete. Enable an ECDHE-based cipher suite", which makes me question if its legit..?

Answer 1

It means that the cryptography from the certificate is breakable - the ROBOT attack is a good write up on how. ECDHE uses elliptic-curve cryptography, which is faster, uses less data for the same level of security, and relies on newer mathematical techniques (although it's not necessarily a good thing...but as a quick aside ECs were needed for solving Fermat's last theorem and that only happened in 1994).

So yes, it's a legit warning. It's probably just popping up because the site hasn't used a ECDHE cipher. Which is far from ideal, but if everybody followed best practices I'd be out of a job.