Supported TLS Versions, Cipher Suites, and Groups
Find out about the TLS versions, cipher suites, and groups supported by API Gateway.
The API Gateway service supports TLS versions 1.2 and 1.3.
Supported Ciphers
TLS 1.3 Cipher Suites
The API Gateway service supports the following cipher suites with TLS version 1.3.
In TLS 1.3, the key exchange method is negotiated separately from the cipher suite.
| Cipher Suite Name (OpenSSL) | Cipher Suite ID | Encryption | Key Size (Bits) | Cipher Suite Name (IANA) | Supported/Deprecated |
|---|---|---|---|---|---|
| TLS_AES_128_GCM_SHA256 | 0x1301 | AES-GCM | 128 | TLS_AES_128_GCM_SHA256 | Supported. |
| TLS_AES_256_GCM_SHA384 | 0x1302 | AES-GCM | 256 | TLS_AES_256_GCM_SHA384 | Supported. |
TLS 1.2 Cipher Suites
The API Gateway service supports the following cipher suites with TLS version 1.2.
In TLS 1.2, the cipher suite specifies the key exchange method.
| Cipher Suite Name (OpenSSL) | Cipher Suite ID | Key Exchange | Encryption | Key Size (Bits) | Cipher Suite Name (IANA) | Supported/Deprecated |
|---|---|---|---|---|---|---|
| ECDHE-RSA-AES128-GCM-SHA256 | 0xc02f | ECDH | AES-GCM | 128 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Supported. |
| ECDHE-RSA-AES128-SHA256 | 0xc027 | ECDH | AES-CBC | 128 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | Deprecated. |
| ECDHE-RSA-AES256-GCM-SHA384 | 0xc030 | ECDH | AES-GCM | 256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Supported. |
| ECDHE-RSA-AES256-SHA384 | 0xc028 | ECDH | AES-CBC | 256 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | Deprecated. |
| DHE-RSA-AES256-GCM-SHA384 | 0x9f | DH | AES-GCM | 256 | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | Supported. |
| DHE-RSA-AES256-SHA256 | 0x6b | DH | AES-CBC | 256 | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | Deprecated. |
| DHE-RSA-AES128-GCM-SHA256 | 0x9e | DH | AES-GCM | 128 | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | Supported. |
| DHE-RSA-AES128-SHA256 | 0x67 | DH | AES-CBC | 128 | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | Deprecated. |
Supported TLS Groups
The API Gateway service supports the following TLS groups for key exchange. Not all groups are available with every supported TLS version.
- X25519MLKEM768
- SecP384r1MLKEM1024
- SecP256r1MLKEM768
- secp256r1
- secp384r1
- secp521r1
Deprecated Ciphers
Starting April 1, 2025, the API Gateway service no longer supports the following legacy ciphers:
- ECDHE-RSA-AES128-SHA256
- ECDHE-RSA-AES256-SHA384
- DHE-RSA-AES256-SHA256
- DHE-RSA-AES128-SHA256