Since there are many test programs that each have some different ideas about what's safe or not, and because this is also adjusted now and again as new vulnerabilities are found, the Access Server's set of web server ciphers can be adjusted by yourself to make it as secure as you need it to be.
There's the "SSL Settings" page in the Admin UI to set which library you want to use (OpenSSL or PolarSSL) and there's an option to set the minimum TLS level for the web services that you want to allow. The web server cipher suite can be adjusted through the command line, see here on how to do this;
https://docs.openvpn.net/docs/access-server/openvpn-access-server-command-line-tools.html#selecting-web-server-ciphersuites
It uses default OpenSSL ciphersuite string format which is also used by other programs like Apache2 and Nginx. With it you can disable certain ciphers.
Good luck.
