See below for the supported TLS versions and ciphersuites
Management Console TLS support
The PKI Hub Management Console supports the following TLS versions.
Key exchange group | TLS version |
|---|---|
P-256 | TLS 1.2, TLS 1,3 |
P-384 | TLS 1.2, TLS 1,3 |
P-521 | TLS 1.2, TLS 1,3 |
X25519 | TLS 1.2, TLS 1,3 |
X25519MLKEM768 | TLS 1,3 |
The following table lists the supported cipher suites.
As shown in the table below, the supported cipher suites may depend on the type of server certificate. The product ships with a self-signed RSA certificate by default.
Ciphersuite | Supported TLS | Supported server certificate |
|---|---|---|
ECDHE-ECDSA-AES256-GCM-SHA384 | TLS 1.2 | ECDSA |
ECDHE-RSA-AES256-GCM-SHA384 | TLS 1.2 | RSA |
ECDHE-ECDSA-CHACHA20-POLY1305 | TLS 1.2 | ECDSA |
ECDHE-RSA-CHACHA20-POLY1305 | TLS 1.2 | RSA |
TLS_AES_256_GCM_SHA384 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_GCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | RSA, ECDSA |
Grafana TLS support
The Grafana user interface supports the following TLS versions.
Key exchange group | TLS version |
|---|---|
P-256 | TLS 1.2, TLS 1,3 |
P-384 | TLS 1.2, TLS 1,3 |
P-521 | TLS 1.2, TLS 1,3 |
X25519 | TLS 1.2, TLS 1,3 |
X25519MLKEM768 | TLS 1,3 |
The following table lists the supported cipher suites.
As shown in the table below, the supported cipher suites may depend on the type of server certificate. The product ships with a self-signed RSA certificate by default.
Ciphersuite | Supported TLS | Supported server certificate |
|---|---|---|
ECDHE-ECDSA-AES256-GCM-SHA384 | TLS 1.2 | ECDSA |
ECDHE-RSA-AES256-GCM-SHA384 | TLS 1.2 | RSA |
ECDHE-ECDSA-CHACHA20-POLY1305 | TLS 1.2 | ECDSA |
ECDHE-RSA-CHACHA20-POLY1305 | TLS 1.2 | RSA |
TLS_AES_256_GCM_SHA384 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_GCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | RSA, ECDSA |
Certificate Authority TLS support
Certificate Authority supports the following TLS versions.
Key exchange group | TLS version |
|---|---|
P-256 | TLS 1.2, TLS 1,3 |
P-384 | TLS 1.2, TLS 1,3 |
P-521 | TLS 1.2, TLS 1,3 |
X25519 | TLS 1.2, TLS 1,3 |
X25519MLKEM768 | TLS 1,3 |
The following table lists the supported cipher suites.
As shown in the table below, the supported cipher suites may depend on the type of server certificate. The product ships with a self-signed RSA certificate by default.
Ciphersuite | Supported TLS | Supported server certificate |
|---|---|---|
ECDHE-ECDSA-AES256-GCM-SHA384 | TLS 1.2 | ECDSA |
ECDHE-RSA-AES256-GCM-SHA384 | TLS 1.2 | RSA |
ECDHE-ECDSA-CHACHA20-POLY1305 | TLS 1.2 | ECDSA |
ECDHE-RSA-CHACHA20-POLY1305 | TLS 1.2 | RSA |
TLS_AES_256_GCM_SHA384 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_GCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | RSA, ECDSA |
Certificate Manager TLS support
Certificate Manager supports the following TLS versions.
Key exchange group | TLS version |
|---|---|
P-256 | TLS 1.2, TLS 1,3 |
P-384 | TLS 1.2, TLS 1,3 |
P-521 | TLS 1.2, TLS 1,3 |
X25519 | TLS 1.2, TLS 1,3 |
X25519MLKEM768 | TLS 1,3 |
The following table lists the supported cipher suites.
As shown in the table below, the supported cipher suites may depend on the type of server certificate. The product ships with a self-signed RSA certificate by default.
Ciphersuite | Supported TLS | Supported server certificate |
|---|---|---|
ECDHE-ECDSA-AES256-GCM-SHA384 | TLS 1.2 | ECDSA |
ECDHE-RSA-AES256-GCM-SHA384 | TLS 1.2 | RSA |
ECDHE-ECDSA-CHACHA20-POLY1305 | TLS 1.2 | ECDSA |
ECDHE-RSA-CHACHA20-POLY1305 | TLS 1.2 | RSA |
TLS_AES_256_GCM_SHA384 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_GCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | RSA, ECDSA |
Certificate Enrollment Gateway TLS support
Certificate Enrollment Gateway supports the following TLS versions.
Key exchange group | TLS version |
|---|---|
P-256 | TLS 1.2, TLS 1,3 |
P-384 | TLS 1.2, TLS 1,3 |
P-521 | TLS 1.2, TLS 1,3 |
X25519 | TLS 1.2, TLS 1,3 |
X25519MLKEM768 | TLS 1,3 |
The following table lists the supported cipher suites.
As shown in the table below, the supported cipher suites may depend on the type of server certificate. The product ships with a self-signed RSA certificate by default.
Ciphersuite | Supported TLS | Supported server certificate |
|---|---|---|
ECDHE-ECDSA-AES256-GCM-SHA384 | TLS 1.2 | ECDSA |
ECDHE-RSA-AES256-GCM-SHA384 | TLS 1.2 | RSA |
ECDHE-ECDSA-CHACHA20-POLY1305 | TLS 1.2 | ECDSA |
ECDHE-RSA-CHACHA20-POLY1305 | TLS 1.2 | RSA |
TLS_AES_256_GCM_SHA384 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_GCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | RSA, ECDSA |
CA Gateway TLS support
CA Gateway supports the following TLS versions.
Key exchange group | TLS version |
|---|---|
ffdhe2048 | TLS 1.2, TLS 1,3 |
ffdhe3072 | TLS 1.2, TLS 1,3 |
ffdhe4096 | TLS 1.2, TLS 1,3 |
ffdhe6144 | TLS 1.2, TLS 1,3 |
ffdhe8192 | TLS 1.2, TLS 1,3 |
secp256r1 | TLS 1.2, TLS 1,3 |
secp384r1 | TLS 1.2, TLS 1,3 |
secp521r1 | TLS 1.2, TLS 1,3 |
x25519 | TLS 1.2, TLS 1,3 |
x448 | TLS 1.2, TLS 1,3 |
CA Gateway provides a Server setting to select the supported ciphersuites. See below for the ones supported by default.
Ciphersuite | Supported TLS | Supported server certificate |
|---|---|---|
TLS_AES_128_CCM_8_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_CCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_AES_128_GCM_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_AES_256_GCM_SHA384 | TLS 1.3 | RSA, ECDSA |
TLS_CHACHA20_POLY1305_SHA256 | TLS 1.3 | RSA, ECDSA |
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | TLS 1.2 | RSA |
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | TLS 1.2 | RSA |
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | TLS 1.2 | ECDSA |
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | TLS 1.2 | ECDSA |
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | TLS 1.2 | ECDSA |
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS 1.2 | RSA |
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | TLS 1.2 | RSA |
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | TLS 1.2 | RSA |
TLS_RSA_WITH_AES_128_GCM_SHA256 | TLS 1.2 | RSA |
TLS_RSA_WITH_AES_256_GCM_SHA384 | TLS 1.2 | RSA |