--- schema_version: "1" id: 31461093303dfb54901253466b27c5300b5388d4f6e4aef4f6db6f2203af5665 title: Supported Cipher Suites collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/cdn-zones-cipher-suite-types.md canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/cdn-zones-cipher-suite-types.html source_site: developer.salesforce.com content_type: documentation content_hash: 3365f00a30f1d9c87f12210eb52fc4bc31f27a9cfd2404b56b0188c4af1d2a5b products: - Composable Storefront - Salesforce APIs --- # Supported Cipher Suites Cipher suites are cipher combinations that are used to negotiate security settings during the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handshake. Make sure you verify the correct cipher settings with your security team, and update your eCDN zone cipher suite settings based on your security requirements. The following SCAPI eCDN endpoints retrieve and restrict the available TLS cipher suites that browsers and devices are allowed to use when accessing a customer’s website/hostname that is served by a specified zone: - [getCipherSuites](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=getCipherSuites) - [updateCipherSuites](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateCipherSuites) **note:** TLS 1.2 or later is recommended for all connections. Use the [B2C CLI](https://developer.salesforce.com/docs/commerce/b2c-commerce/guides/b2c-developer-tooling.md): ```bash # Required scopes: sfcc.cdn-zones, sfcc.cdn-zones.rw export SFCC_CLIENT_ID='your-account-manager-client-id' export SFCC_CLIENT_SECRET='your-account-manager-client-secret' export SFCC_SHORTCODE='your-short-code' npx @salesforce/b2c-cli ecdn cipher-suites get \ --tenant-id abcd_stg --zone stg-abcd-example-com.cc-ecdn.net npx @salesforce/b2c-cli ecdn cipher-suites update \ --tenant-id abcd_stg --zone stg-abcd-example-com.cc-ecdn.net \ --suite-type Modern ``` ## Cipher Suite Types ### Modern Cipher Suites Modern cipher suites offer the best security and performance by limiting your clients to modern devices and browsers. All modern cipher suites use forward secrecy encryption and support authenticated encryption (AEAD). The following Modern cipher suites are supported: - `ECDHE-ECDSA-AES128-GCM-SHA256` - `ECDHE-ECDSA-CHACHA20-POLY1305` - `ECDHE-RSA-AES128-GCM-SHA256` - `ECDHE-RSA-CHACHA20-POLY1305` - `ECDHE-ECDSA-AES256-GCM-SHA384` - `ECDHE-RSA-AES256-GCM-SHA384` ### Compatible Cipher Suites Compatible cipher suites provide broader compatibility with support for additional cipher suites: - `ECDHE-ECDSA-AES128-GCM-SHA256` - `ECDHE-ECDSA-CHACHA20-POLY1305` - `ECDHE-RSA-AES128-GCM-SHA256` - `ECDHE-RSA-CHACHA20-POLY1305` - `ECDHE-ECDSA-AES256-GCM-SHA384` - `ECDHE-RSA-AES256-GCM-SHA384`, - `ECDHE-ECDSA-AES128-SHA256` - `ECDHE-RSA-AES128-SHA256` - `ECDHE-ECDSA-AES256-SHA384` - `ECDHE-RSA-AES256-SHA384` ### Legacy Cipher Suites Legacy cipher suites include all cipher suites that our eCDN partners support. By default, these legacy cipher suites are selected, because this provides the broadest compatibility for customer implementations, although it includes some weaker ciphers. The [getCipherSuites](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=getCipherSuites) endpoint returns a `cipherSuiteType` of `Legacy` and an empty cipher suite array, which means that the following default legacy cipher suites are used: - `AEAD-AES128-GCM-SHA256` - `AEAD-AES256-GCM-SHA384` - `AEAD-CHACHA20-POLY1305-SHA256` - `ECDHE-ECDSA-AES128-GCM-SHA256` - `ECDHE-ECDSA-CHACHA20-POLY1305` - `ECDHE-RSA-AES128-GCM-SHA256` - `ECDHE-RSA-CHACHA20-POLY1305` - `ECDHE-ECDSA-AES256-GCM-SHA384` - `ECDHE-RSA-AES256-GCM-SHA384` - `ECDHE-ECDSA-AES128-SHA256` - `ECDHE-RSA-AES128-SHA256` - `ECDHE-ECDSA-AES256-SHA384` - `ECDHE-RSA-AES256-SHA384` - `ECDHE-ECDSA-AES128-SHA` - `ECDHE-RSA-AES128-SHA` - `AES128-GCM-SHA256` - `AES128-SHA256` - `AES128-SHA` - `ECDHE-RSA-AES256-SHA` - `AES256-GCM-SHA384` - `AES256-SHA256` - `AES256-SHA` - `DES-CBC3-SHA` ### Custom Cipher Suites To combine or specify a set of cipher suites that you want to allow, use the [updateCipherSuites](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateCipherSuites) endpoint to specify the custom cipher suites that you want to support and set `cipherSuiteType` to `Custom`. When you set `cipherSuiteType` to `Custom`, you must specify a minimum of 5 valid ciphers. ## TLS 1.3 Cipher Suites If you require TLS 1.3 for HTTPS connections, you must first enable TLS 1.3 connections to be accepted in your zone using the Business Manager crypto settings of the zone or using the [updateSecuritySettings](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateSecuritySettings) endpoint. This automatically enables the following ciphers: - `AEAD-AES128-GCM-SHA256` (IANA name: `TLS_AES_128_GCM_SHA256`) - `AEAD-AES256-GCM-SHA384` (IANA name: `TLS_AES_256_GCM_SHA384`) - `AEAD-CHACHA20-POLY1305-SHA256` (IANA name: `TLS_CHACHA20_POLY1305_SHA256`) ## Cipher Suite Summary | OpenSSL Cipher Name | IANA Name | Available in Cipher Suite Type | Minimum TLS Protocol Version | | ----------------------------- | --------------------------------------------- | ------------------------------ | ---------------------------- | | ECDHE-ECDSA-AES128-GCM-SHA256 | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | Modern, Compatible, Legacy | TLS 1.2 | | ECDHE-ECDSA-CHACHA20-POLY1305 | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | Modern, Compatible, Legacy | TLS 1.2 | | ECDHE-RSA-AES128-GCM-SHA256 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Modern, Compatible, Legacy | TLS 1.2 | | ECDHE-RSA-CHACHA20-POLY1305 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | Modern, Compatible, Legacy | TLS 1.2 | | ECDHE-ECDSA-AES128-SHA256 | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | Compatible, Legacy | TLS 1.2 | | ECDHE-ECDSA-AES128-SHA | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | Legacy | TLS 1.0 | | ECDHE-RSA-AES128-SHA256 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | Compatible, Legacy | TLS 1.2 | | ECDHE-RSA-AES128-SHA | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | Legacy | TLS 1.0 | | AES128-GCM-SHA256 | TLS_RSA_WITH_AES_128_GCM_SHA256 | Legacy | TLS 1.2 | | AES128-SHA256 | TLS_RSA_WITH_AES_128_CBC_SHA256 | Legacy | TLS 1.2 | | AES128-SHA | TLS_RSA_WITH_AES_128_CBC_SHA | Legacy | TLS 1.0 | | ECDHE-ECDSA-AES256-GCM-SHA384 | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | Modern, Compatible, Legacy | TLS 1.2 | | ECDHE-ECDSA-AES256-SHA384 | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | Compatible, Legacy | TLS 1.2 | | ECDHE-RSA-AES256-GCM-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Modern, Compatible, Legacy | TLS 1.2 | | ECDHE-RSA-AES256-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | Compatible, Legacy | TLS 1.2 | | ECDHE-RSA-AES256-SHA | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | Legacy | TLS 1.0 | | AES256-GCM-SHA384 | TLS_RSA_WITH_AES_256_GCM_SHA384 | Legacy | TLS 1.2 | | AES256-SHA256 | TLS_RSA_WITH_AES_256_CBC_SHA256 | Legacy | TLS 1.2 | | AES256-SHA | TLS_RSA_WITH_AES_256_CBC_SHA | Legacy | TLS 1.0 | | DES-CBC3-SHA | TLS_RSA_WITH_3DES_EDE_CBC_SHA | Legacy | TLS 1.0 | | AEAD-AES128-GCM-SHA256 | TLS_AES_128_GCM_SHA256 | Custom | TLS 1.3 | | AEAD-AES256-GCM-SHA384 | TLS_AES_256_GCM_SHA384 | Custom | TLS 1.3 | | AEAD-CHACHA20-POLY1305-SHA256 | TLS_CHACHA20_POLY1305_SHA256 | Custom | TLS 1.3 | ## Frequently Asked Questions (FAQs) - What cipher suites are needed for Payment Card Industry Data Security Standard (PCI DSS) compliance? - The following cipher suites are recommended for PCI DSS compliance. Check with your security team to verify compliance with your site's security requirements. - `ECDHE-ECDSA-AES128-GCM-SHA256` - `ECDHE-RSA-AES128-GCM-SHA256` - `ECDHE-ECDSA-AES256-GCM-SHA384` - `ECDHE-RSA-AES256-GCM-SHA384` - `ECDHE-ECDSA-CHACHA20-POLY1305` - `ECDHE-RSA-CHACHA20-POLY1305` - How can I disable weak cipher suites listed in the SSL Labs weak ciphers report? - To disable weak ciphers listed in a Qualys SSL Labs report: 1. Use the previous table to get the corresponding cipher suite information. 2. Identify which cipher suites you want to allow. 3. Use the [updateCipherSuites](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateCipherSuites) endpoint to specify the custom cipher suites that you want to update and set `cipherSuiteType` to `Custom` for the applicable zone. - What is the order in which cipher suites are used? - ECDSA cipher suites are prioritized over RSA, and then cipher suites are condered in the order they were set. This means that, if both ECDSA and RSA are used, Cloudflare presents the ECDSA ciphers first in the order they were set. Then the RSA ciphers are presented in the order they were set. - Why am I getting the `ERR_SSL_VERSION_OR_CIPHER_MISMATCH` cipher suite mismatch error when visiting my site? - Make sure that the certificate is compatible with the chosen cipher suites for your zone. For example, if you upload an RSA certificate, your cipher suite selection cannot specify support for only ECDSA certificates.