Cipher Suites for Load Balancers

Use cipher suites with a load balancer to determine the security, compatibility, and speed of HTTPS traffic.

A cipher suite is a logical entity for a set of algorithms, or ciphers, using Transport Layer Security (TLS) to determine the security, compatibility, and speed of HTTPS traffic. All ciphers are associated with at least one version of TLS 1.0, 1.1, 1.2, and 1.3.

When you create or edit a listener, you add or can change the associated cipher suite. There can only be one cipher suite attached to a listener at a time, which controls all allowable ciphers. The cipher suite attached to the listener must have all ciphers for which you require support. See Listeners for Load Balancers for more information.

Click Cipher Suites under Resources in the load balancer's Details page to display the Cipher suites page. This page contains a button for creating cipher suites.

This page also contains a list of all the available cipher suites, both ones that came originally preconfigured from Oracle Cloud Infrastructure (Predefined=Yes), and ones that you created yourself (Predefined=No). You can change or delete those cipher suites you created yourself . You can't change or delete predefined cipher suites.

Here is reference information for ciphers and cipher suites:

• Predefined cipher suites.

• Deprecated cipher suites.

• Supported ciphers.

• Deprecated ciphers.

You can perform the following cipher suite management tasks:

• Create a cipher suite.

• Display a list of the cipher suites for a compartment.

• View the details of a cipher suite.

• Update the configuration of a cipher suite.

• Delete a cipher suite from the compartment.

Note the following items related to cipher suites:

• Ensure compatibility between specified SSL protocols and configured ciphers in the cipher suite, or else the SSL handshake is not successful.

• Ensure compatibility between configured ciphers in the cipher suite and configured certificates (for example, RSA-based ciphers require an RSA certificate whereas ECDSA-based ciphers require ECDSA certificates).

• For all load balancer and listener resources that were created before the cipher suites feature was available, the following apply:

  • When running a GET operation, the cipher suite value returned is by default "oci-default-ssl-cipher-suite-v1" inside the listener's SSL configuration. You can update this value by editing the load balancer or listener.

  • When running a GET operation, the cipher suite value returned is displayed as "oci-customized-ssl-cipher-suite" inside the listener's SSL configuration if the cipher configuration customized after the load balancer creation through Oracle operations.

• For all existing load balancer backendsets that were created before the cipher suites feature was available, running a GET operation displays the cipher suite value as "oci-wider-compatible-ssl-cipher-suite-v1" inside the backendset's SSL configuration.

• If running a GET operation on a load balancer listener displays the cipher suite value as "oci-customized-ssl-cipher-suite," then choose the appropriate cipher suite name (either pre-defined or custom defined cipher suites) when updating these load balancers.

• The cipher suite name "oci-customized-ssl-cipher-suite" is reserved for use by Oracle and isn't acceptable as an available name for a custom cipher suite.