Compliance standards

Consider the following recommendations on custom cipher suites for when your organization needs to comply with regulatory standards.

Refer to Customize cipher suites to learn how to specify cipher suites at zone level or per hostname.

Warning

Also enable TLS 1.3 on your zone and, when opting for PCI DSS, make sure to up your Minimum TLS version to 1.2. Refer to Cipher suites and TLS protocols to learn more.

PCI DSS

Recommended cipher suites for compliance with the Payment Card Industry Data Security Standard (PCI DSS) ↗. Enhances payment card data security.

Cipher suites list

AEAD-AES128-GCM-SHA256¹, AEAD-AES256-GCM-SHA384², AEAD-CHACHA20-POLY1305-SHA256³, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-CHACHA20-POLY1305

If you are customizing cipher suites via API, refer to Steps and API examples for a snippet you can copy with the formatted array.

FIPS-140-2

Recommended cipher suites for compliance with the Federal Information Processing Standard (140-2) ↗. Used to approve cryptographic modules.

Cipher suites list

AES128-GCM-SHA256, AES128-SHA, AES128-SHA256, AES256-SHA, AES256-SHA256, DES-CBC3-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-SHA, ECDHE-RSA-AES256-SHA384

If you are customizing cipher suites via API, refer to Steps and API examples for a snippet you can copy with the formatted array.