You will need to support one of these ciphers:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

The plan to disable support for weak ciphers on the server includes all of this:

• Any cipher with key length less than 128 bits
• Export-class cipher suites
• NULL ciphers
• Ciphers that support unauthenticated modes
• Ciphers assessed at security strengths below 112 bits
• All RC4 ciphers
• All CBC mode ciphers due to POODLE, Zombie POODLE, GOLDENDOODLE, 0-Length OpenSSL, and Sleeping POODLE vulnerabilities
• All 64-bit block ciphers
• All ciphers using MD5 and SHA1 for cryptographic hash functions

Thus, the following ciphers currently supported by the server are weak and will be disabled:

• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)