Which TLS ciphers should we turn off?

Anything without forward secrecy or authenticated encryption, and everything on the old lists. In practice: disable RC4, which RFC 7465 prohibits in TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS., 3DES and other 64-bit block ciphers, export-grade and NULL ciphers, static RSA key exchange, and CBC-mode suites with SHA-1 where your clients allow it. Keep the TLS 1.3 suites, AES-GCM and ChaCha20-Poly1305, and for TLS 1.2 use ECDHE key exchange with AES-GCM or ChaCha20-Poly1305. Use published configuration guides rather than inventing your own: Mozilla's server-side TLS recommendations and the technical guidelines of agencies such as Germany's BSI give tested profiles for modern and older clients. Before you change a production server, check which clients connect and what they offer, from server logs or a view of the handshakes, so you do not lock out an old device. Re-test from outside afterwards with a TLS scanner, and enable the hybrid group X25519MLKEM768 where your software supports it.

← All 40 questions on Encryption and encrypted trafficAll topics