I too was looking for a solution to this problem and over the past couple of days only came up with one solution: Modify the code!

I followed the guide on this site on how to setup the build environment with the JDK and ANT.

http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/source-b uild.html

After much searching and trial and error I found the file that needs to be modified:  AdminConsolePlugin.java

(You can find this in the source code tree under .\src\java\org\jivesoftware\openfire\container )

I am attaching my modified copy.  I made a couple changes but the most important is in the function "public void startup()"

I created an array of ciphers I wanted to exclude from being enabled (apparently this is how Jetty works) as such:

        String[] weakCiphers = {
           "SSL_RSA_WITH_3DES_EDE_CBC_SHA",
           "SSL_DHE_RSA_WITH_DES_CBC_SHA",
           "SSL_DHE_DSS_WITH_DES_CBC_SHA",
           "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
           "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
           "SSL_RSA_WITH_DES_CBC_SHA",
           "SSL_RSA_EXPORT_WITH_RC4_40_MD5",
           "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",
           "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
           "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
           "SSL_RSA_WITH_NULL_MD5",
           "SSL_RSA_WITH_NULL_SHA",
           "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA",
           "SSL_DH_anon_WITH_DES_CBC_SHA",
           "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",
           "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"
           };

Then..a bit lower when the code creates it's https connector, I call the setExcludeCipherSuites method and pass it my list of weak ciphers:

     JiveSslConnector httpsConnector = new JiveSslConnector();

     httpsConnector.setExcludeCipherSuites(weakCiphers);

With this change I saved the file and rebuilt the program using Ant (refer to those build instructions).

This recompiles all the source files and creates the jar files the program uses.  They are placed into a "target" folder at the same level as the "src" folder.

The affected file is in openfire.jar so this is the file that needs to be replaced on the server (located in the lib sub-folder).

I replaced the original openfire.jar file with the my modified copy (while the software was shutdown of course) and viola, no more weak ciphers being reported by our PCI scans.

I know this post falls a little short of being a "how-to" but hopefully will help anyone really wanting to disable those darn weak ciphers so you can admin the software without going through hoops to access it.

** Note:  I had to make this change for the web based admin console.  For client connections follow wes's advice above to make TLS required. **