Cipher Suites
On Compute Cloud@Customer, a cipher suite is a set of algorithms or ciphers that help secure network connections using Transport Layer Security (TLS). You configure cipher suites for a load balancer to determine the security, compatibility and speed of HTTPS traffic. All ciphers are associated with at least one version of TLS (1.0, 1.1, 1.2).
Predefined Cipher Suites
On Compute Cloud@Customer, the Load Balancing service supports predefined cipher suites.
This cipher suite contains a restricted set of ciphers that are only supported in TLS version 1.2 and meet stricter compliance requirements.
-
ECDHE-RSA-AES128-GCM-SHA256
-
ECDHE-RSA-AES128-SHA256
-
ECDHE-RSA-AES256-GCM-SHA384
-
ECDHE-RSA-AES256-SHA384
-
DHE-RSA-AES256-GCM-SHA384
-
DHE-RSA-AES256-SHA256
-
DHE-RSA-AES128-GCM-SHA256
-
DHE-RSA-AES128-SHA256
This cipher suite offers a wider set of ciphers, but still limited to TLS version 1.2 only.
-
ECDHE-ECDSA-AES128-GCM-SHA256
-
ECDHE-RSA-AES128-GCM-SHA256
-
ECDHE-ECDSA-AES128-SHA256
-
ECDHE-RSA-AES128-SHA256
-
ECDHE-ECDSA-AES256-GCM-SHA384
-
ECDHE-RSA-AES256-GCM-SHA384
-
ECDHE-ECDSA-AES256-SHA384
-
ECDHE-RSA-AES256-SHA384
-
AES128-GCM-SHA256
-
AES128-SHA256
-
AES256-GCM-SHA384
-
AES256-SHA256
-
DHE-RSA-AES256-GCM-SHA384
-
DHE-RSA-AES256-SHA256
-
DHE-RSA-AES128-GCM-SHA256
-
DHE-RSA-AES128-SHA256
This cipher suite supports the broadest set of ciphers. It contains ciphers supported by TLS versions 1.1 and 1.2.
-
ECDHE-ECDSA-AES128-GCM-SHA256
-
ECDHE-RSA-AES128-GCM-SHA256
-
ECDHE-ECDSA-AES128-SHA256
-
ECDHE-RSA-AES128-SHA256
-
ECDHE-ECDSA-AES128-SHA
-
ECDHE-RSA-AES128-SHA
-
ECDHE-ECDSA-AES256-GCM-SHA384
-
ECDHE-RSA-AES256-GCM-SHA384
-
ECDHE-ECDSA-AES256-SHA384
-
ECDHE-RSA-AES256-SHA384
-
ECDHE-RSA-AES256-SHA
-
ECDHE-ECDSA-AES256-SHA
-
AES128-GCM-SHA256
-
AES128-SHA256
-
AES128-SHA
-
AES256-GCM-SHA384
-
AES256-SHA256
-
AES256-SHA
-
DHE-RSA-AES256-GCM-SHA384
-
DHE-RSA-AES256-SHA256
-
DHE-RSA-AES128-GCM-SHA256
-
DHE-RSA-AES128-SHA256
This cipher suite contains all supported ciphers.
TLS version 1.2:
-
ECDHE-ECDSA-AES128-GCM-SHA256
-
ECDHE-RSA-AES128-GCM-SHA256
-
ECDHE-ECDSA-AES128-SHA256
-
ECDHE-RSA-AES128-SHA256
-
ECDHE-ECDSA-AES256-GCM-SHA384
-
ECDHE-RSA-AES256-GCM-SHA384
-
ECDHE-ECDSA-AES256-SHA384
-
ECDHE-RSA-AES256-SHA384
-
AES128-SHA256
-
AES256-GCM-SHA384
-
AES256-SHA256
-
DHE-RSA-AES256-GCM-SHA384
-
DHE-RSA-AES256-SHA256
-
DHE-RSA-AES128-GCM-SHA256
-
DHE-RSA-AES128-SHA256
-
DH-DSS-AES256-GCM-SHA384
-
DHE-DSS-AES256-GCM-SHA384
-
DH-RSA-AES256-GCM-SHA384
-
DHE-DSS-AES256-SHA256
-
DH-RSA-AES256-SHA256
-
DH-DSS-AES256-SHA256
-
ECDH-RSA-AES256-GCM-SHA384
-
ECDH-ECDSA-AES256-GCM-SHA384
-
ECDH-RSA-AES256-SHA384
-
ECDH-ECDSA-AES256-SHA384
-
DH-DSS-AES128-GCM-SHA256
-
DHE-DSS-AES128-GCM-SHA256
-
DH-RSA-AES128-GCM-SHA256
-
DHE-DSS-AES128-SHA256
-
DH-RSA-AES128-SHA256
-
DH-DSS-AES128-SHA256
-
ECDH-RSA-AES128-GCM-SHA256
-
ECDH-ECDSA-AES128-GCM-SHA256
-
ECDH-RSA-AES128-SHA256
-
ECDH-ECDSA-AES128-SHA256
TLS version 1.1:
-
ECDHE-ECDSA-AES128-SHA
-
ECDHE-ECDSA-AES256-SHA
-
ECDHE-RSA-AES128-SHA
-
ECDHE-RSA-AES256-SHA
-
AES128-GCM-SHA256
-
AES128-SHA
-
AES256-SHA
-
DES-CBC3-SHA
-
DHE-RSA-AES256-SHA
-
DHE-RSA-AES128-SHA
-
DHE-RSA-CAMELLIA256-SHA
-
DHE-RSA-CAMELLIA128-SHA
-
DHE-RSA-SEED-SHA
-
DHE-RSA-AES256-SHA
-
DHE-DSS-AES256-SHA
-
DH-RSA-AES256-SHA
-
DH-DSS-AES256-SHA
-
DHE-RSA-CAMELLIA256-SHA
-
DHE-DSS-CAMELLIA256-SHA
-
DH-RSA-CAMELLIA256-SHA
-
DH-DSS-CAMELLIA256-SHA
-
ECDH-RSA-AES256-SHA
-
ECDH-ECDSA-AES256-SHA
-
CAMELLIA256-SHA
-
PSK-AES256-CBC-SHA
-
DHE-RSA-AES128-SHA
-
DHE-DSS-AES128-SHA
-
DH-RSA-AES128-SHA
-
DH-DSS-AES128-SHA
-
DHE-RSA-CAMELLIA128-SHA
-
DHE-DSS-CAMELLIA128-SHA
-
DH-RSA-CAMELLIA128-SHA
-
DH-DSS-CAMELLIA128-SHA
-
ECDH-RSA-AES128-SHA
-
ECDH-ECDSA-AES128-SHA
-
CAMELLIA128-SHA
-
PSK-AES128-CBC-SHA
-
API SPEC
Custom Cipher Suites 🔗
On Compute Cloud@Customer,
Instead of selecting from the predefined cipher suites, you can create a cipher suite of your own to match the specific requirements of your environment. You build a custom cipher suite by adding individual ciphers associated with the TLS versions used in your configuration. A custom cipher suite must contain at least one cipher. Include only ciphers for the TLS versions that your environment effectively supports.
-
Ensure compatibility between specified SSL protocols and configured ciphers in the cipher suite, otherwise the SSL handshake will fail.
-
Ensure compatibility between configured ciphers in the cipher suite and configured certificates. For example: RSA-based ciphers require an RSA certificate, whereas ECDSA-based ciphers require ECDSA certificates.
Supported Ciphers 🔗
On Compute Cloud@Customer, the Load Balancing service supports specific ciphers.
Certificate |
Cipher Suite |
Key Exchange |
Encryption |
Bits |
Cipher Suite Name (IANA) |
---|---|---|---|---|---|
ECDHE-ECDSA-AES128-GCM-SHA256 |
[0xc02b] |
ECDH |
AESGCM |
128 |
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
ECDHE-RSA-AES128-GCM-SHA256 |
[0xc02f] |
ECDH |
AESGCM |
128 |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
ECDHE-ECDSA-AES128-SHA256 |
[0xc023] |
ECDH |
AES |
128 |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 |
ECDHE-RSA-AES128-SHA256 |
[0xc027] |
ECDH |
AES |
128 |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
ECDHE-ECDSA-AES256-GCM-SHA384 |
[0xc02c] |
ECDH |
AESGCM |
256 |
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
ECDHE-RSA-AES256-GCM-SHA384 |
[0xc030] |
ECDH |
AESGCM |
256 |
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
ECDHE-ECDSA-AES256-SHA384 |
[0xc024] |
ECDH |
AES |
256 |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 |
ECDHE-RSA-AES256-SHA384 |
[0xc028] |
ECDH |
AES |
256 |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
AES128-GCM-SHA256 |
[0x9c] |
RSA |
AESGCM |
128 |
TLS_RSA_WITH_AES_128_GCM_SHA256 |
AES128-SHA256 |
[0x3c] |
RSA |
AES |
128 |
TLS_RSA_WITH_AES_128_CBC_SHA256 |
AES256-GCM-SHA384 |
[0x9d] |
RSA |
AESGCM |
256 |
TLS_RSA_WITH_AES_256_GCM_SHA384 |
AES256-SHA256 |
[0x3d] |
RSA |
AES |
256 |
TLS_RSA_WITH_AES_256_CBC_SHA256 |
DHE-RSA-AES256-GCM-SHA384 |
[0x9f] |
DH |
AESGCM |
256 |
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 |
DHE-RSA-AES256-SHA256 |
[0x6b] |
DH |
AES |
256 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 |
DHE-RSA-AES128-GCM-SHA256 |
[0x9e] |
DH |
AESGCM |
128 |
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
DHE-RSA-AES128-SHA256 |
[0x67] |
DH |
AES |
128 |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 |
DH-DSS-AES256-GCM-SHA384 |
[0xa5] |
DH/DSS |
AESGCM |
256 |
TLS_DH_DSS_WITH_AES_256_GCM_SHA384 |
DHE-DSS-AES256-GCM-SHA384 |
[0xa3] |
DH |
AESGCM |
256 |
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 |
DH-RSA-AES256-GCM-SHA384 |
[0xa1] |
DH/RSA |
AESGCM |
256 |
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 |
DHE-DSS-AES256-SHA256 |
[0x6a] |
DH |
AES |
256 |
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 |
DH-RSA-AES256-SHA256 |
[0x69] |
DH/RSA |
AES |
256 |
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 |
DH-DSS-AES256-SHA256 |
[0x68] |
DH/DSS |
AES |
256 |
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 |
ECDH-RSA-AES256-GCM-SHA384 |
[0xc032] |
ECDH/RSA |
AESGCM |
256 |
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 |
ECDH-ECDSA-AES256-GCM-SHA384 |
[0xc02e] |
ECDH/ECDSA |
AESGCM |
256 |
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 |
ECDH-RSA-AES256-SHA384 |
[0xc02a] |
ECDH/RSA |
AES |
256 |
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 |
ECDH-ECDSA-AES256-SHA384 |
[0xc026] |
ECDH/ECDSA |
AES |
256 |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 |
DH-DSS-AES128-GCM-SHA256 |
[0xa4] |
DH/DSS |
AESGCM |
128 |
TLS_DH_DSS_WITH_AES_128_GCM_SHA256 |
DHE-DSS-AES128-GCM-SHA256 |
[0xa2] |
DH |
AESGCM |
128 |
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 |
DH-RSA-AES128-GCM-SHA256 |
[0xa0] |
DH/RSA |
AESGCM |
128 |
TLS_DH_RSA_WITH_AES_128_GCM_SHA256 |
DHE-DSS-AES128-SHA256 |
[0x40] |
DH |
AES |
128 |
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 |
DH-RSA-AES128-SHA256 |
[0x3f] |
DH/RSA |
AES |
128 |
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 |
DH-DSS-AES128-SHA256 |
[0x3e] |
DH/DSS |
AES |
128 |
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 |
ECDH-RSA-AES128-GCM-SHA256 |
[0xc031] |
ECDH/RSA |
AESGCM |
128 |
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 |
ECDH-ECDSA-AES128-GCM-SHA256 |
[0xc02d] |
ECDH/ECDSA |
AESGCM |
128 |
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 |
ECDH-RSA-AES128-SHA256 |
[0xc029] |
ECDH/RSA |
AES |
128 |
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 |
ECDH-ECDSA-AES128-SHA256 |
[0xc025] |
ECDH/ECDSA |
AES |
128 |
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 |
Certificate |
Cipher Suite |
Key Exchange |
Encryption |
Bits |
Cipher Suite Name (IANA) |
---|---|---|---|---|---|
ECDHE-ECDSA-AES128-SHA |
[0xc009] |
ECDH |
AES |
128 |
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
ECDHE-RSA-AES128-SHA |
[0xc013] |
ECDH |
AES |
128 |
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
ECDHE-RSA-AES256-SHA |
[0xc014] |
ECDH |
AES |
256 |
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
ECDHE-ECDSA-AES256-SHA |
[0xc00a] |
ECDH |
AES |
256 |
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA |
AES128-SHA |
[0x2f] |
RSA |
AES |
128 |
TLS_RSA_WITH_AES_128_CBC_SHA |
AES256-SHA |
[0x35] |
RSA |
AES |
256 |
TLS_RSA_WITH_AES_256_CBC_SHA |
DHE-RSA-AES128-SHA |
[0x33] |
DH |
AES |
128 |
TLS_DHE_RSA_WITH_AES_128_CBC_SHA |
DHE-RSA-CAMELLIA256-SHA |
[0x88] |
DH |
Camellia |
256 |
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA |
DHE-RSA-CAMELLIA128-SHA |
[0x45] |
DH |
Camellia |
128 |
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA |
DHE-DSS-CAMELLIA256-SHA |
[0x87] |
DH |
Camellia |
256 |
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA |
DHE-DSS-CAMELLIA128-SHA |
[0x44] |
DH |
Camellia |
128 |
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA |
DHE-RSA-SEED-SHA |
[0x9a] |
DH |
SEED |
128 |
TLS_DHE_RSA_WITH_SEED_CBC_SHA |
DHE-DSS-SEED-SHA |
[0x99] |
DH |
SEED |
128 |
TLS_DHE_DSS_WITH_SEED_CBC_SHA |
DH-RSA-SEED-SHA |
[0x98] |
DH/RSA |
SEED |
128 |
TLS_DH_RSA_WITH_SEED_CBC_SHA |
DH-DSS-SEED-SHA |
[0x97] |
DH/DSS |
SEED |
128 |
TLS_DH_DSS_WITH_SEED_CBC_SHA |
DHE-RSA-AES256-SHA |
[0x39] |
DH |
AES |
256 |
TLS_DHE_RSA_WITH_AES_256_CBC_SHA |
DHE-DSS-AES256-SHA |
[0x38] |
DH |
AES |
256 |
TLS_DHE_DSS_WITH_AES_256_CBC_SHA |
DH-RSA-AES256-SHA |
n/a |
n/a |
n/a |
n/a |
n/a |
DH-DSS-AES256-SHA |
[0x36] |
DH/DSS |
AES |
256 |
TLS_DH_DSS_WITH_AES_256_CBC_SHA |
DH-RSA-CAMELLIA256-SHA |
[0x86] |
DH/RSA |
Camellia |
256 |
TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA |
DH-DSS-CAMELLIA256-SHA |
[0x85] |
DH/DSS |
Camellia |
256 |
TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA |
ECDH-RSA-AES256-SHA |
[0xc00f] |
ECDH/RSA |
AES |
256 |
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA |
ECDH-ECDSA-AES256-SHA |
[0xc005] |
ECDH/ECDSA |
AES |
256 |
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA |
CAMELLIA256-SHA |
[0x84] |
RSA |
Camellia |
256 |
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA |
PSK-AES256-CBC-SHA |
[0x8d] |
PSK |
AES |
256 |
TLS_PSK_WITH_AES_256_CBC_SHA |
DHE-DSS-AES128-SHA |
[0x32] |
DH |
AES |
128 |
TLS_DHE_DSS_WITH_AES_128_CBC_SHA |
DH-RSA-AES128-SHA |
[0x31] |
DH/RSA |
AES |
128 |
TLS_DH_RSA_WITH_AES_128_CBC_SHA |
DH-DSS-AES128-SHA |
[0x30] |
DH/DSS |
AES |
128 |
TLS_DH_DSS_WITH_AES_128_CBC_SHA |
DH-RSA-CAMELLIA128-SHA |
[0x43] |
DH/RSA |
Camellia |
128 |
TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA |
DH-DSS-CAMELLIA128-SHA |
[0xbb] |
DH/DSS |
Camellia |
128 |
TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 |
ECDH-RSA-AES128-SHA |
[0xc00e] |
ECDH/RSA |
AES |
128 |
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA |
ECDH-ECDSA-AES128-SHA |
[0xc004] |
ECDH/ECDSA |
AES |
128 |
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA |
SEED-SHA |
[0x96] |
RSA |
SEED |
128 |
TLS_RSA_WITH_SEED_CBC_SHA |
CAMELLIA128-SHA |
n/a |
n/a |
n/a |
n/a |
n/a |
PSK-AES128-CBC-SHA |
[0x8c] |
PSK |
AES |
128 |
TLS_PSK_WITH_AES_128_CBC_SHA |
DES-CBC3-SHA |
[0x0701c0] |
RSA |
3DES |
168 |
SSL_CK_DES_192_EDE3_CBC_WITH_SHA |
IDEA-CBC-SHA |
[0x07] |
RSA |
IDEA |
128 |
TLS_RSA_WITH_IDEA_CBC_SHA |
ECDHE-RSA-DES-CBC3-SHA |
[0xc012] |
ECDH |
3DES |
168 |
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA |
ECDHE-ECDSA-DES-CBC3-SHA |
[0xc008] |
ECDH |
3DES |
168 |
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA |
DHE-RSA-DES-CBC3-SHA |
n/a |
n/a |
n/a |
n/a |
n/a |
DHE-DSS-DES-CBC3-SHA |
n/a |
n/a |
n/a |
n/a |
n/a |
DH-RSA-DES-CBC3-SHA |
[0x10] |
DH/RSA |
3DES |
168 |
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA |
DH-DSS-DES-CBC3-SHA |
[0x0d] |
DH/DSS |
3DES |
168 |
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA |
ECDH-RSA-DES-CBC3-SHA |
[0xc00d] |
ECDH/RSA |
3DES |
168 |
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA |
ECDH-ECDSA-DES-CBC3-SHA |
[0xc003] |
ECDH/ECDSA |
3DES |
168 |
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA |
PSK-3DES-EDE-CBC-SHA |
[0x8b] |
PSK |
3DES |
168 |
TLS_PSK_WITH_3DES_EDE_CBC_SHA |
KRB5-IDEA-CBC-SHA |
[0x21] |
KRB5 |
IDEA |
128 |
TLS_KRB5_WITH_IDEA_CBC_SHA |
KRB5-DES-CBC3-SHA |
[0x1f] |
KRB5 |
3DES |
168 |
TLS_KRB5_WITH_3DES_EDE_CBC_SHA |
KRB5-IDEA-CBC-MD5 |
[0x25] |
KRB5 |
IDEA |
128 |
TLS_KRB5_WITH_IDEA_CBC_MD5 |
KRB5-DES-CBC3-MD5 |
[0x23] |
KRB5 |
3DES |
168 |
TLS_KRB5_WITH_3DES_EDE_CBC_MD5 |
ECDHE-RSA-RC4-SHA |
[0xc011] |
ECDH |
RC4 |
128 |
TLS_ECDHE_RSA_WITH_RC4_128_SHA |
ECDHE-ECDSA-RC4-SHA |
[0xc007] |
ECDH |
RC4 |
128 |
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA |
ECDH-RSA-RC4-SHA |
[0xc00c] |
ECDH/RSA |
RC4 |
128 |
TLS_ECDH_RSA_WITH_RC4_128_SHA |
ECDH-ECDSA-RC4-SHA |
[0xc002] |
ECDH/ECDSA |
RC4 |
128 |
TLS_ECDH_ECDSA_WITH_RC4_128_SHA |
RC4-SHA |
[0x05] |
RSA |
RC4 |
128 |
TLS_RSA_WITH_RC4_128_SHA |
RC4-MD5 |
[0x04] |
RSA |
RC4 |
128 |
TLS_RSA_WITH_RC4_128_MD5 |
PSK-RC4-SHA |
[0x8a] |
PSK |
RC4 |
128 |
TLS_PSK_WITH_RC4_128_SHA |
KRB5-RC4-SHA |
[0x20] |
KRB5 |
RC4 |
128 |
TLS_KRB5_WITH_RC4_128_SHA |
KRB5-RC4-MD5 |
[0x24] |
KRB5 |
RC4 |
128 |
TLS_KRB5_WITH_RC4_128_MD5 |