Module 8 · TLS Cipher Suite Selection

Manish Garg
Manish Garg Associate of (ISC)² · RingSafe
Apr 27, 2026
1 min read
Read as

Last updated: April 29, 2026

100% Free

No signup. No paywall. No catch. One of our 10 most-requested practitioner modules — published in full so anyone can learn for free. We earn through consulting, not by gating knowledge.

See all 10 free modules →

TLS 1.3 covered in Networking Module 10. This is the operational hardening view.

TLS 1.3 covered in Networking Module 10. This is the operational hardening view.

The 2026 baseline

  • TLS 1.2 + TLS 1.3 only
  • Disable TLS 1.0, 1.1 entirely
  • Forward-secret ciphers only (ECDHE-*)
  • AEAD ciphers (GCM or ChaCha20-Poly1305)
  • Strong elliptic curves (X25519, P-256, P-384)
  • HSTS enabled
Want this for your team?

Custom team training + practitioner advisory

Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.

Book team training call Replies in 4 working hrs · India-only · Senior consultants
← Previous · Module 7
Module 7 · PKI Fundamentals
← Back to Academy Hub
Continue Learning

Other modules in this track

View all modules
Academy
Module 1 · Beginner

Symmetric, asymmetric, hashing, MACs, password hashing, RNG, libsodium, post-quantum status, the cardinal rule.

Apr 22, 2026 · 5 min read
Academy
Module 2 · Intermediate

TLS 1.2/1.3, cipher suites, handshake, certificate validation, HSTS, CT, common misconfigurations, testing with testssl.sh.

Apr 22, 2026 · 4 min read
Academy
Module 3 · Intermediate

CAs, cert types, ACME, lifecycle, revocation, internal PKI, service mesh PKI, code signing, lifetime trends.

Apr 22, 2026 · 5 min read