---
schema_version: "1"
id: 9ce31d451345ade1da10b6be85b5a43134d9e0115f4ba19930560deb7b8be7b8
title: Cipher Suites
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/anypoint-security/cipher-suites.md
canonical_url: https://docs.mulesoft.com/anypoint-security/cipher-suites
source_site: docs.mulesoft.com
content_type: documentation
content_hash: d0ea894bbc5b547a116c31fe9b4d2f91b8949b3835e507af7b0c12ff9e79391f
description: MuleSoft Documentation Site
latest: true
---
---
product: Security
version: master
---

# Cipher Suites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

When you configure a TLS context, default ciphers are applied to it based on the TLS version you
selected. If you don’t use the defaults, you can select ciphers that match the configured keystore
to ensure that TLS can set up a connection:

- For a keystore with an RSA key (the most common type), select ciphers that contain the string
  `RSA`.

- If you are using ECC ciphers, select ciphers that contain the string `ECDSA`.  
  Consult TLS standards and documentation for more information.

- If a client device supports AES-dedicated CPU instructions, use the AES-GCM ciphers.  
  If the client does not support AES-dedicated instructions (some mobile and IoT devices), the
  client negotiates to use `CHACHA20-POLY1305`. It takes two (client and server) to perform the
  CHACHA.

## TLS 1.3 Cipher Suites

TLS 1.3 support is available only if you are using the **Anypoint Security** target.

The cipher suites for TLS 1.3 are listed with those of TLS 1.2 and TLS 1.1 and appear in the **No
known vulnerabilities and support Perfect Forward Secrecy** grouping. When you use cipher suites
that start with the string `TLS`, keep in mind the following:

- The new cipher suites for TLS 1.3 cannot be used with TLS 1.1 and TLS 1.2.

- The cipher suites for TLS 1.2 and TLS 1.1 cannot be used for TLS 1.3.

- The new cipher suites for TLS 1.3 are defined differently from the cipher suites for earlier
  versions of TLS and do not specify the certificate type (for example, RSA, DSA, ECDSA) or the key
  exchange mechanism (for example, DHE or ECHDE).

## Select Ciphers

In addition to the defaults, you can select other ciphers to use with the selected TLS version. Each
TLS context can have multiple ciphers.

1.  Click **Ciphers** to select available ciphers.  
    If you select a **TLS Version** value of **TLS 1.3**, keep the default selection, which includes
    all three of the TLS cipher suites.

2.  If you selected **Mule** as the **Target** value for the TLS context, you can define custom
    ciphers to use with your proxy instance.

3.  Click **Save**.

If you add a cipher that’s not supported by the Java runtime, you receive a warning, but this does
not prevent you from saving the TLS context.

## TLS Support on Anypoint Runtime Fabric

The TLS 1.3 protocol is enabled by default for those clients that support it.

OpenSSL 1.1.1 and TLS 1.3 provide the following security enhancements and performance improvements
over TLS 1.2:

- Double or more than double TLS 1.2 connection performance throughput boost over an earlier Runtime
  Fabric internal load balancer running on OpenSSL 1.0.2

- Reduction of one round trip in a full handshake

- Added TLS 1.2 and TLS 1.3 ChaCha20-Poly1305 ciphers for better mobile and IoT device support

- Protection against downgrade attacks

- Continued support for both RSA and ECDSA keys

- Removal of obsolete and insecure features from TLS 1.2 and TLS 1.1.

## See Also

- [Add a TLS Context for Mule](https://docs.mulesoft.com/anypoint-security/secret-group-add-tls-context)

- [Configure a TLS Context for Runtime Fabric Load Balancer](https://docs.mulesoft.com/anypoint-security/configure-tls-context-rtf-lb)