Disabling anonymous ciphers in Apache not working

Solution 1:

openssl ciphers -v with the cipher string will show the list.

You don't disable null encryption with !eNULL. OpenSSL does not enable it even in ALL but might as well make turning it off explicit.

Check for any config files containing SSL. And confirm it is httpd listening on that port.

You can get a second opinion with a local SSL/TLS scan script. There are a couple good ones that show exactly which ciphers they use.

Strong ciphers is relative. OpenSSL 0.9.8 can't really do TLS 1.1 or 1.2 so it isn't going to provide modern security (or score well in SSLLabs).

Solution 2:

You can add the !aNULL to the cipher string list to disable the inclusion of ciphers that has anonymous algorithms during the SSL handshakes