如何将端口的tls密码套件做限制

Nmap scan report for xxxxx
Host is up (0.0021s latency).

PORT STATE SERVICE VERSION
8883/tcp open ssl/unknown
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
| TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 (rsa 2048) - A
| TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_PSK_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_PSK_WITH_AES_128_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: server
|_ least strength: A

Service detection performed. Please report any incorrect results at Nmap OS/Service Fingerprint and Correction Submission Page .
Nmap done: 1 IP address (1 host up) scanned in 83.92 seconds

nmap扫描出来的mqtts端口的加密算法,我想去掉最后两个弱加密算法(TLS_RSA_PSK_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_PSK_WITH_AES_128_CBC_SHA (rsa 2048) - A),如何在emqx的配置文件中配置。

要用openssl格式,解决了