# Which TLS ciphers should we turn off?

Anything without forward secrecy or authenticated encryption, and everything on the old lists. In practice: disable RC4, which RFC 7465 prohibits in TLS, 3DES and other 64-bit block ciphers, export-grade and NULL ciphers, static RSA key exchange, and CBC-mode suites with SHA-1 where your clients allow it. Keep the TLS 1.3 suites, AES-GCM and ChaCha20-Poly1305, and for TLS 1.2 use ECDHE key exchange with AES-GCM or ChaCha20-Poly1305. Use published configuration guides rather than inventing your own: Mozilla's server-side TLS recommendations and the technical guidelines of agencies such as Germany's BSI give tested profiles for modern and older clients. Before you change a production server, check which clients connect and what they offer, from server logs or a view of the handshakes, so you do not lock out an old device. Re-test from outside afterwards with a TLS scanner, and enable the hybrid group X25519MLKEM768 where your software supports it.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/which-tls-ciphers-should-we-turn-off

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is forward secrecy?](https://netsenx.com/en/faq/what-is-forward-secrecy)
- [What is encryption, in plain terms?](https://netsenx.com/en/faq/what-is-encryption-in-plain-terms)
- [What is the difference between symmetric and asymmetric encryption?](https://netsenx.com/en/faq/what-is-the-difference-between-symmetric-and-asymmetric-encryption)
- [How long should an encryption key be?](https://netsenx.com/en/faq/how-long-should-an-encryption-key-be)
- [What is a hash function?](https://netsenx.com/en/faq/what-is-a-hash-function)