All Products
Search

This Product

    API Gateway:Configure a custom HTTPS cipher suite

    Document Center

    API Gateway:Configure a custom HTTPS cipher suite

    Last Updated:Jun 21, 2026

    Hypertext Transfer Protocol Secure (HTTPS) is the secure version of HTTP. It uses the SSL/TLS protocol to encrypt data in transit. An HTTPS cipher suite is a set of cryptographic algorithms that a client (such as a web browser) and a server use to establish a secure connection. To meet specific security, compatibility, performance, and compliance requirements, Cloud-native API Gateway lets you customize the cipher suites for your gateway.

    Overview

    An HTTPS cipher suite typically includes the following components:

    1. A key exchange algorithm: used to securely exchange cryptographic keys. Common key exchange algorithms include RSA, Diffie-Hellman (DH), and ECDHE (Elliptic Curve Diffie-Hellman).

    2. A message authentication code (MAC) algorithm: used to ensure data integrity and authenticity. Common MAC algorithms include HMAC-SHA256 and HMAC-SHA384.

    3. A symmetric encryption algorithm: used to encrypt the data itself. Common symmetric encryption algorithms include Advanced Encryption Standard (AES) and ChaCha20.

    Limitations

    Your Cloud-native API Gateway instance must be version 2.0.0 or later.

    Supported cipher suites

    The following table lists the cipher suites supported by Cloud-native API Gateway and their corresponding TLS versions.

    Suite name

    Supported TLS versions

    ECDHE-ECDSA-AES128-SHA

    TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

    ECDHE-ECDSA-AES256-SHA

    TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

    ECDHE-RSA-AES128-SHA

    TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

    ECDHE-RSA-AES256-SHA

    TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

    AES128-SHA

    TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

    AES256-SHA

    TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

    ECDHE-ECDSA-AES128-GCM-SHA256

    TLS 1.2, TLS 1.3

    ECDHE-ECDSA-CHACHA20-POLY1305

    TLS 1.2, TLS 1.3

    ECDHE-RSA-AES128-GCM-SHA256

    TLS 1.2, TLS 1.3

    ECDHE-RSA-CHACHA20-POLY1305

    TLS 1.2, TLS 1.3

    AES128-GCM-SHA256

    TLS 1.2, TLS 1.3

    ECDHE-ECDSA-AES256-GCM-SHA384

    TLS 1.2, TLS 1.3

    ECDHE-RSA-AES256-GCM-SHA384

    TLS 1.2, TLS 1.3

    AES256-GCM-SHA384

    TLS 1.2, TLS 1.3

    Procedure

    1. Log on to the API Gateway console.

    2. In the left-side navigation pane, click Domain Name. In the top navigation bar, select a region.

    3. If you have not created a domain name, click Add Domain Name. If you have an existing domain name, find it in the list and click Edit in the Actions column.

      Add domain name

      1. On the Add Domain Name page, select HTTPS from the Domain Name drop-down list.

      2. Click Advanced Options. In the Cipher Suite section, select Custom. In the list of available algorithms, select the ones you want to use, and then click Create.

      Edit domain name

      1. On the Edit Domain Name page, select HTTPS from the Domain Name drop-down list.

      2. Click Advanced Options. In the Cipher Suite section, select Custom. In the list of available algorithms, select the ones you want to use, and then click OK.

    Verify the result

    1. Configure a custom HTTPS cipher suite for a domain name. For this example, configure the cipher suite to allow only ECDHE-ECDSA-AES128-GCM-SHA256.

    2. Use a curl command to send a request that specifies the allowed cipher suite, ECDHE-ECDSA-AES128-GCM-SHA256.

      curl -iv --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256' https://bantian.alijam.top/get --resolve "bantian.alijam.top:443:8.154.33.131"

    3. The request using the specified cipher suite ECDHE-ECDSA-AES128-GCM-SHA256 succeeds. The TLS handshake log shows that the client and server successfully negotiated to use the ECDHE-ECDSA-AES128-GCM-SHA256 cipher suite.

      ~ curl -iv --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256' https://bantian.alijam.top/get --resolve "bantian.alijam.top:443:8.xxx.xxx.xxx"
* Added bantian.alijam.top:443:8.xxx.xxx.xxx to DNS cache
* Hostname bantian.alijam.top was found in DNS cache
*   Trying 8.154.33.131:443...
* Connected to bantian.alijam.top (8.154.33.131) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ECDHE-ECDSA-AES128-GCM-SHA256
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
> GET /get HTTP/2
> Host: bantian.alijam.top
>
< HTTP/2 200

    4. A request that specifies a disallowed cipher suite, such as ECDHE-ECDSA-AES256-GCM-SHA256, fails because the client and server cannot agree on a cipher suite.

      →  ~ curl -iv --ciphers 'ECDHE-ECDSA-AES256-GCM-SHA256' https://bantian.alijam.top/get --resolve "bantian.alijam.top:443:8.154.33.131"
* Added bantian.alijam.top:443:8.154.33.131 to DNS cache
* Hostname bantian.alijam.top was found in DNS cache
*   Trying 8.154.33.131:443...
* Connected to bantian.alijam.top (8.154.33.131) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* failed setting cipher list: ECDHE-ECDSA-AES256-GCM-SHA256
* Closing connection 0
curl: (59) failed setting cipher list: ECDHE-ECDSA-AES256-GCM-SHA256