Cipher Suite
The set of cryptographic algorithms used for the connection
A Cipher Suite is a specific combination of cryptographic algorithms that defines how data will be encrypted, authenticated, and verified during an SSL/TLS connection. Each cipher suite consists of four main components: a key exchange algorithm (like RSA, ECDHE, or DHE), an authentication algorithm (like RSA or ECDSA), a bulk encryption algorithm (like AES, ChaCha20), and a message authentication code (like SHA-256 or POLY1305). During the TLS handshake, the client and server negotiate which cipher suite to use based on their supported algorithms and security preferences. Modern cipher suites prioritize forward secrecy (using ECDHE key exchange), strong encryption (AES-256 or ChaCha20), and secure authentication (ECDSA or RSA). Examples include TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 or TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256. The chosen cipher suite directly impacts the security strength, performance, and compatibility of the connection. Weak or deprecated cipher suites can create security vulnerabilities, so it's important to disable outdated algorithms and prefer modern, secure combinations.
Cipher mismatches can cause Cloudflare Error 525 or ERR_SSL_PROTOCOL_ERROR.