Glossary · Security

Cipher Suite

A cipher suite is a named bundle of algorithms for key exchange, authentication, bulk encryption and integrity used in a TLS connection.

Updated October 14, 2026

A cipher suite is a named combination of cryptographic algorithms that two TLS endpoints agree on during the handshake. In TLS 1.2 a name such as ECDHE-RSA-AES128-GCM-SHA256 packs together the key exchange (ECDHE), authentication (RSA), bulk cipher (AES-128-GCM) and hash (SHA-256).

Why it matters

The suite you allow decides how strong and how compatible your HTTPS is. Old options such as RC4, 3DES, export-grade ciphers and CBC-mode suites are weak or deprecated, while AEAD ciphers like AES-GCM and ChaCha20-Poly1305 are the modern baseline.

TLS 1.3 simplified this. It has only a handful of suites, for example TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256, and key exchange and authentication are negotiated separately.

Example

An nginx configuration allowing modern protocols:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Mozilla's SSL configuration generator is a good source for current recommended lists.

Common mistakes

  • Copying a hardened list from an old tutorial that now blocks legitimate clients.
  • Editing ssl_ciphers and expecting it to change TLS 1.3 suites. Those are configured separately.
  • Forgetting to retest after the change.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCertificate Chain (Chain of Trust)A certificate chain is the ordered path of certificates from a server's leaf certificate through intermediates up to a trusted root.Glossary · SecurityElliptic Curve Cryptography (ECC)Elliptic curve cryptography is public-key cryptography built on elliptic curve math, giving strong security with much smaller keys than RSA.Glossary · SecurityForward Secrecy (PFS)Forward secrecy means each TLS session uses its own temporary keys, so stealing a server's private key later cannot decrypt past traffic.Guide · SSL & SecurityHow to Check an SSL Certificate Expiry Date (3 Easy Ways)Find out when your SSL certificate expires using a free online checker, your browser, or one command, and learn what to do if the date is close or has passed.7 min readGuide · SSL & SecuritySSL Certificate Types Explained: DV, OV, EV, Wildcard and SANCompare DV, OV and EV certificates, wildcard and multi-domain (SAN) options, and learn what certificate lifetimes really are today and where they are heading.7 min readGuide · SSL & SecuritySSL/TLS Certificate Errors Explained: Causes, Diagnosis and FixesDecode browser errors like ERR_CERT_COMMON_NAME_INVALID and ERR_CERT_AUTHORITY_INVALID, diagnose them with openssl and curl, and fix each root cause.10 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.