/system/tls_global

A map of TLS 1.2 cipher suites allowed and their priority order. The map key is a priority level with priority_1 being the highest priority. The mapped value is a cipher suite name. When a priority level is not configured, it maps to its default cipher suite, as indicated below: priority_1. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384. priority_2. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256. priority_3. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. priority_4. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. priority_5. TLS_RSA_WITH_AES_256_GCM_SHA384. priority_6. TLS_RSA_WITH_AES_128_GCM_SHA256. If users want to leave a priority level not mapping to any cipher suite, not even the default suite, they should set the priority level to map to 'NONE' explicitly. If two priority levels are set to map to the same cipher suite, the cipher suite will be assigned the higher priority level, and the lower level will effectively map to 'NONE'.

A map of TLS 1.3 cipher suites allowed and their priority order. The map key is a priority level with priority_1 being the highest priority. The mapped value is a cipher suite name. When a priority level is not configured, it maps to its default cipher suite, as indicated below: priority_1. TLS_AES_256_GCM_SHA384. priority_2. TLS_AES_128_GCM_SHA256. priority_3. TLS_CHACHA20_POLY1305_SHA256. priority_4. TLS_AES_128_CCM_8_SHA256. priority_5. TLS_AES_128_CCM_SHA256. If users want to leave a priority level not mapping to any cipher suite, not even the default suite, they should set the priority level to map to 'NONE' explicitly. If two priority levels are set to map to the same cipher suite, the cipher suite will be assigned the higher priority level, and the lower level will effectively map to 'NONE'.

A map of TLS key exchange algorithms allowed and their priority order. The map key is a priority level with priority_1 being the highest priority. The mapped value is an algorithm name. When a priority level is not configured, it maps to its default algorithm, as indicated below: priority_1. secp521r1. priority_2. secp384r1. priority_3. secp256r1. priority_4. X25519. priority_5. X448. priority_6. ffdhe8192. priority_7. ffdhe6144. priority_8. ffdhe4096. priority_9. ffdhe3072. priority_10. ffdhe2048. If users want to leave a priority level not mapping to any algorithm, not even the default algorithm, they should set the priority level to map to 'NONE' explicitly. If two priority levels are set to map to the same cipher suite, the cipher suite will be assigned the higher priority level, and the lower level will effectively map to 'NONE'.