Cipher Suite

A cipher suite is a named combination of cryptographic algorithms that two TLS endpoints agree on during the handshake. In TLS 1.2 a name such as ECDHE-RSA-AES128-GCM-SHA256 packs together the key exchange (ECDHE), authentication (RSA), bulk cipher (AES-128-GCM) and hash (SHA-256).

Why it matters

The suite you allow decides how strong and how compatible your HTTPS is. Old options such as RC4, 3DES, export-grade ciphers and CBC-mode suites are weak or deprecated, while AEAD ciphers like AES-GCM and ChaCha20-Poly1305 are the modern baseline.

TLS 1.3 simplified this. It has only a handful of suites, for example TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256, and key exchange and authentication are negotiated separately.

Example

An nginx configuration allowing modern protocols:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Mozilla's SSL configuration generator is a good source for current recommended lists.

Common mistakes

• Copying a hardened list from an old tutorial that now blocks legitimate clients.
• Editing ssl_ciphers and expecting it to change TLS 1.3 suites. Those are configured separately.
• Forgetting to retest after the change.

Related

• TLS handshake
• Forward secrecy
• Symmetric encryption
• टूल: TLS version checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.