diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index b11285cf..28957292 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -4200,11 +4200,15 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                  s->version != DTLS1_VERSION))
                 ok = 0;
 
-            /* not use ECDSA under TLS v1.2 */
-            // if ((alg_a & SSL_aECDSA) && s->version != TLS1_2_VERSION) ok = 0;
-	    if ((alg_a & SSL_aRSA) &&
+            /* Skip SHA(SHA1) cipher over TLS v1.2 */
+            if (s->version == TLS1_2_VERSION &&
+                c->algorithm_mac & SSL_SHA1)
+                ok = 0;
+
+            /* Not use weak cipher after TLSv1.0 */
+            if ((alg_a & SSL_aRSA) &&
                 (alg_k & SSL_kRSA) &&
-               	(s->version != TLS1_VERSION)) ok = 0;
+                (s->version != TLS1_VERSION)) ok = 0;
 
 #ifndef OPENSSL_NO_PSK
             /* with PSK there must be server callback set */