Home / Knowledge hub / Cipher suite
Knowledge hub
Cipher suite
The set of algorithms two sides agree to use when they set up a secure connection.
What it means
A cipher suite is a named bundle of algorithms that two sides agree to use when they open a secure connection. In TLS 1.2 the name covers how keys are exchanged, how the server is authenticated, how data is encrypted and how it is checked for tampering.
Think of it as the menu both sides read from. The browser lists what it can do, the server picks one it also supports, and the connection continues on that choice. If the menu includes weak items, a poor choice can be forced or negotiated.
Why it matters
The suite decides how much protection the traffic really has. An old suite can leave sign-in forms, payment calls and API tokens readable or alterable by anyone positioned on the network, even though the address bar shows a padlock.
It also appears in audits and questionnaires. Buyers and assessors ask which protocol versions and suites you accept, and a scan that finds legacy options turns into a finding you have to explain. Cleaning it up is cheap compared with explaining it.
How it shows up
You set it in the web server, load balancer, CDN or cloud gateway rather than in application code. Defaults vary by product and age, so a server that was configured years ago may still offer options that modern guidance has dropped. TLS 1.3 reduced the list to a handful of strong choices.
The mistakes repeat. Old protocol versions stay switched on for a legacy client nobody can name. Suites using RC4, 3DES, export-grade keys or no encryption remain enabled. Different hosts behind one domain use different settings. Check each public endpoint, including the forgotten ones, with a TLS scanner.
Questions people ask
Cipher suite, answered
Is a cipher suite the same as TLS?
TLS is the protocol. The cipher suite is the set of algorithms it uses on one particular connection.
A single TLS version can offer many suites, and the two sides choose one during the handshake.
Which cipher suites are considered weak?
Suites using RC4, 3DES, single DES, export-grade keys or NULL encryption are weak, as are those with no authentication. Anything built on SSL 2.0 or 3.0 should be gone too.
NIST SP 800-52 Revision 2 sets the guidance for US government use and is a sound reference for everyone else.
Does TLS 1.3 still have cipher suites?
Yes, but fewer. TLS 1.3 defines a small set of suites, all using authenticated encryption, and handles key exchange separately. The long mix-and-match names of TLS 1.2 are gone.
That removes many of the ways to configure a connection badly.
How do we check which suites a server offers?
Run a TLS scanner against each public hostname and read the list of accepted protocol versions and suites. Compare it with current guidance rather than with last year's output.
Check load balancers and CDNs as well as origin servers, because the setting that matters is the one the client reaches.
Does a strong cipher suite make an app secure?
No. It protects the data while it travels. It does nothing about flaws in the application itself, such as a missing access control check or an injection point.
Treat it as one layer in defence in depth.
Related
Terms that sit next to this one
TLS
The protocol that encrypts traffic between a browser and a server.
Encryption in transit
Protecting data while it travels between a browser and your servers.
HTTPS
The encrypted web protocol, and the minimum for anything with a login.
Perfect forward secrecy
Session keys that are discarded, so old traffic stays safe if a key leaks later.
HSTS
A header telling browsers to use HTTPS only for your site, every time.
Which suites does your server still offer?
A padlock says nothing about the flaws behind it. We find vulnerabilities in your web app and its APIs, and report only what we actually exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.