Cipher suite

In TLS 1.2, a suite name spells out each part: `ECDHE-RSA-AES128-GCM-SHA256` means elliptic-curve ephemeral key exchange, an RSA certificate, AES-128 in Galois/Counter Mode for encryption, and SHA-256 for the handshake hash.

In TLS 1.3 the name covers only the symmetric algorithm and hash — `TLS_AES_128_GCM_SHA256` — because key exchange and authentication are negotiated separately and only strong options remain.

There are five suites in TLS 1.3 against dozens in TLS 1.2, which is the point: fewer choices means fewer wrong ones.

Server preference decides which is used when both sides support several, so the server's ordering matters on TLS 1.2.

The registry of suite names is maintained by IANA, and the names in a server configuration file may follow either the IANA spelling or OpenSSL's older one, which is a frequent source of a configuration that silently matches nothing.

A suite using ephemeral key exchange generates a fresh key for each session and discards it afterwards.

The consequence is that recording the traffic and later obtaining the server's private key does not decrypt it, because that key was never used to encrypt the data.

Suites without it — the old RSA key transport suites — allow exactly that retrospective decryption, which is why they were removed.

TLS 1.3 provides forward secrecy in every suite. On TLS 1.2 it must be configured by choosing ECDHE or DHE suites.

Anything using RC4, 3DES, MD5, SHA-1 or export-grade key sizes. These are broken or weak and have been for years.

Suites without forward secrecy, for the reason above.

CBC-mode suites, which have a long history of padding-related attacks; AEAD suites such as GCM and ChaCha20-Poly1305 are the replacement.

The cost of disabling them is compatibility with very old clients — which, in practice, means clients that also cannot negotiate TLS 1.2 at all, so the loss is usually already taken.

ChaCha20-Poly1305 is worth keeping enabled alongside AES: it is substantially faster on devices without hardware AES acceleration, which describes a large share of lower-cost mobile phones.

`openssl s_client -connect example.com:443 -servername example.com` reports the suite actually negotiated.

Testing which suites are accepted means attempting each, which scanning tools automate; doing it by hand is possible with `-cipher` but tedious.

Check every hostname separately. A CDN-fronted site and its origin frequently have different configurations, and the origin is usually the older one.

Prefer changing the server's configured list over changing individual suites. Most web servers ship a sensible modern default, and hand-edited lists age badly.