Cipher Suite (Cipher Suite)
The Importance of Cipher Suite
The cipher suite your server negotiates directly determines the security of every HTTPS connection. A weak cipher suite can make an otherwise properly configured TLS connection vulnerable. For example, cipher suites using RC4 can be broken, those using CBC mode in TLS 1.0 are vulnerable to BEAST, and those without forward secrecy expose past sessions if the key is compromised.
Server configuration controls which cipher suites are offered and in what order. The server should prefer the strongest suites (ECDHE key exchange, AES-256-GCM or ChaCha20-Poly1305 encryption) and disable known-weak ones (RC4, 3DES, DES, NULL, EXPORT-grade). The cipher suite order matters - clients may select a weak suite if the server offers it first.
TLS 1.3 drastically simplified this by only allowing five cipher suites, all of which are strong AEAD ciphers with forward secrecy. This "secure by default" approach means TLS 1.3 cannot be misconfigured with weak ciphers. TLS 1.2 requires more careful configuration because it supports both strong and weak suites.
Key Parameters
| Cipher Suite Component | Recommended | Avoid |
|---|---|---|
| Key Exchange | ECDHE | RSA (no forward secrecy) |
| Authentication | ECDSA or RSA | DSA |
| Bulk Encryption | AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305 | RC4, 3DES, DES, CBC mode |
| Hash/MAC | SHA-256, SHA-384 | MD5, SHA-1 |
Testing Your Configuration
An SSL checker lists all cipher suites your server offers, often color-coded by strength. Weak or deprecated suites are flagged. Verify that all offered suites use AEAD encryption (GCM or ChaCha20) and ECDHE key exchange for forward secrecy.
Check SSL Certificate