What’s the issue?
The database mirroring endpoint is the TCP endpoint that Always On Availability Groups and database mirroring use to exchange traffic between replicas. Alongside its port and authentication settings, each endpoint carries an encryption configuration that determines whether that traffic is encrypted and with which algorithm.
SQL Server supports AES and the older RC4, along with the option to disable encryption entirely. Endpoints can also be configured to negotiate between the two, which appears as AES RC4 or RC4 AES depending on which algorithm is preferred.
This check identifies database mirroring endpoints whose encryption algorithm is NONE, RC4, or one of the negotiated combinations that still permits RC4.
Why is this a problem?
An endpoint with no encryption sends availability group data across the network in the clear. That traffic is the transaction log stream, which carries the actual contents of every insert, update, and delete, so anyone able to capture packets between replicas can read the data as it is written.
RC4 is deprecated and considered weak. Microsoft has marked it for removal, and the algorithm has known cryptographic flaws that make it unsuitable for protecting data in transit. An endpoint configured to negotiate between AES and RC4 can still end up using RC4, so the presence of either combination leaves the weaker option available.
What should you do about this?
Review the current configuration by querying sys.database_mirroring_endpoints and checking the encryption_algorithm_desc value on every replica, since the setting is per endpoint and may differ across the group.
Alter each endpoint to require AES, for example ALTER ENDPOINT [Hadr_endpoint] FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED ALGORITHM AES);, substituting the actual endpoint name. Make the change on every replica so both ends of each connection agree.
Be careful when changing this, since a mismatch between replicas during the transition can interrupt connections. Verify afterward that replicas reconnect and synchronization resumes.