aa.com's use of the dated/weak/insecure RC4 has been discussed in the thread about website outages (and how web browsers will drop support for RC4, which can prevent use of aa.com because the website doesn't support/offer anything else besides RC4).

I sent a msg to webserves about it and only got a boilerplate statement saying their site is secure and offering an explanation of what SSL is. I reiterated my points in a reply and never heard from them again.

The frontend webservers are run by Akamai, and I'm both surprised and disappointed that a company dedicated to the running of websites can do such a poor job. However, people I know who've either worked for Akamai or dealt with them as a customer/client had only bad things to say about the company.