# TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA cipher suite

> TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x00,0x11): DHE/DSS · DES40-CBC · SSL 3.0, TLS 1.0. ssl.sh rating: Insecure. OpenSSL/GnuTLS names and Nginx/Apache config.

Source: https://ssl.sh/ciphers/tls-dhe-dss-export-with-des40-cbc-sha/
Last updated: 2026-11-10

TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x00,0x11) is a cipher suite for SSL 3.0, TLS 1.0: DHE key exchange, DSS authentication, DES40-CBC encryption and SHA1 message authentication. ssl.sh rates it Insecure.

| Field | Value |
|---|---|
| IANA | TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA |
| Hex code | 0x00,0x11 |
| OpenSSL | Not available in OpenSSL 3.5 |
| GnuTLS | - |
| Key exchange | DHE |
| Authentication | DSS |
| Encryption | DES40-CBC |
| MAC | SHA1 |
| TLS versions | SSL 3.0, TLS 1.0 |
| Rating | Insecure |
| IANA "Recommended" | D |
| References | RFC 4346, RFC 10015 |

## What each component means

A [cipher suite](https://ssl.sh/glossary/cipher-suite/) names the algorithms a client and server agree on in one handshake. TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA combines DHE key exchange, DSS authentication, DES40-CBC encryption and SHA1 integrity protection. Each part is explained below with its known weaknesses; for the bigger picture see [how cipher suites work](https://ssl.sh/learn/cipher-suites/).

Key exchange: DHE, ephemeral finite-field [Diffie-Hellman](https://ssl.sh/glossary/diffie-hellman/). A new DH key pair per handshake gives [forward secrecy](https://ssl.sh/glossary/forward-secrecy/), but in TLS 1.2 the server alone picks the group and the client cannot ask for a stronger one; [RFC 7919](https://www.rfc-editor.org/rfc/rfc7919) (2016) added negotiated FFDHE groups, which saw little uptake. [Logjam](https://ssl.sh/glossary/logjam/) (CVE-2015-4000, 2015) broke servers that still accepted 512-bit export groups and showed that huge numbers of sites shared the same few 1024-bit primes, and the Raccoon timing attack (2020) exploits how TLS 1.2 strips leading zero bytes from the DH secret. Those are the reasons [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022) gives for telling TLS 1.2 implementations not to negotiate TLS_DHE_* suites.

This is a 1990s EXPORT suite: the cipher is cut to 40 bits and the Diffie-Hellman group to 512 bits to meet old US export rules. [Logjam](https://ssl.sh/glossary/logjam/) (CVE-2015-4000, May 2015) showed that a man-in-the-middle could downgrade a normal DHE handshake to DHE_EXPORT on servers that still accepted it and then break the 512-bit group within minutes, because most servers used the same few primes and the expensive precomputation only had to be done once per prime.

Authentication: DSS, meaning DSA certificates. Publicly trusted CAs only issue RSA and ECDSA certificates under the CA/Browser Forum Baseline Requirements, TLS 1.3 has no DSA signature scheme, and NIST's FIPS 186-5 (2023) no longer approves DSA for creating signatures, so DSS suites only survive in legacy private PKIs.

Encryption: DES reduced to 40 bits of secret key, an export-grade cipher that ordinary hardware brute-forces quickly. [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022) forbids any suite with less than 112 bits of security and names export-level 40- and 56-bit ciphers explicitly.

Mode: CBC with MAC-then-encrypt. TLS 1.2 and earlier compute the HMAC over the plaintext, then pad and encrypt, so a receiver has to decrypt before it can check integrity. That ordering produced a long run of padding-oracle attacks: [BEAST](https://ssl.sh/glossary/beast/) (CVE-2011-3389) against TLS 1.0's predictable IVs, Lucky Thirteen (CVE-2013-0169, 2013), which times the MAC check, and [POODLE](https://ssl.sh/glossary/poodle/) (CVE-2014-3566, 2014) against SSL 3.0's unchecked padding. [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022) says CBC suites SHOULD NOT be used unless the encrypt_then_mac extension ([RFC 7366](https://www.rfc-editor.org/rfc/rfc7366)) is also negotiated.

Integrity: HMAC-SHA1. [SHA-1](https://ssl.sh/glossary/sha-1/) collisions are practical (SHAttered, 2017), but HMAC does not rely on collision resistance, so HMAC-SHA1 record MACs are not considered broken; this suite's weak points lie elsewhere.

## Why this rating

- Export-grade cryptography (40/56-bit keys), broken since the 1990s and exploited by FREAK and Logjam.
- Uses single DES, whose 56-bit key can be brute-forced; RFC 5246 removed DES suites from TLS 1.2.

## Which TLS libraries support it

Support for TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA as read from each library's own source code or official documentation on 2026-11-10. “Enabled by default” means the library negotiates it with no configuration; “off by default” means it is implemented but has to be switched on.

| Library | Status | Details |
|---|---|---|
| OpenSSL 3.5 | Not supported | - |
| GnuTLS | Not supported | - |
| BoringSSL | Not supported | - |
| Go crypto/tls | Not supported | - |
| NSS 3.133 | Not supported | - |
| Firefox | Not supported | - |
| Java 21 (SunJSSE) | Supported, off by default | blocked by “`DES`” in the default jdk.tls.disabledAlgorithms |
| Windows Schannel (Windows 11 / Server 2022) | Not supported | - |
| rustls 0.23.46 | Not supported | - |

None of the 9 libraries tracked here enables it by default. Supported but off by default in: Java 21 (SunJSSE).

NSS shows the library's own defaults; Firefox switches every NSS suite off at start-up and re-enables only those with a security.ssl3.* or security.tls13.* preference. Java defaults are derived from the jdk.tls.disabledAlgorithms value Oracle documents for JDK 21, which later updates may extend. The OpenSSL and GnuTLS rows only show whether the suite is implemented.

- [BoringSSL — ssl/ssl_cipher.cc (main)](https://boringssl.googlesource.com/boringssl/+/refs/heads/main/ssl/ssl_cipher.cc) (2026-11-10)
- [Go — src/crypto/tls/cipher_suites.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go) (2026-11-10)
- [Go — src/crypto/tls/defaults.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/defaults.go) (2026-11-10)
- [NSS — lib/ssl/ssl3con.c (as vendored in Firefox)](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/lib/ssl/ssl3con.c) (2026-11-10)
- [NSS — TAG-INFO](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/TAG-INFO) (2026-11-10)
- [Firefox — security/manager/ssl/nsNSSComponent.cpp](https://github.com/mozilla-firefox/firefox/blob/main/security/manager/ssl/nsNSSComponent.cpp) (2026-11-10)
- [Firefox — modules/libpref/init/StaticPrefList.yaml](https://github.com/mozilla-firefox/firefox/blob/main/modules/libpref/init/StaticPrefList.yaml) (2026-11-10)
- [Oracle — JDK 21 Providers Documentation: SunJSSE Cipher Suites](https://docs.oracle.com/en/java/javase/21/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2) (2026-11-10)
- [Oracle — JDK 21 JSSE Reference Guide: jdk.tls.disabledAlgorithms](https://docs.oracle.com/en/java/javase/21/security/java-secure-socket-extension-jsse-reference-guide.html) (2026-11-10)
- [Microsoft Learn — TLS Cipher Suites in Windows 11](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11) (2026-11-10)
- [Microsoft Learn — TLS Cipher Suites in Windows Server 2022](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022) (2026-11-10)
- [docs.rs — rustls 0.23.46 crypto::aws_lc_rs (default provider)](https://docs.rs/rustls/0.23.46/src/rustls/crypto/aws_lc_rs/mod.rs.html) (2026-11-10)

## History and standards status

TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x00,0x11) is registered in the IANA TLS Cipher Suites registry with [RFC 4346](https://www.rfc-editor.org/rfc/rfc4346), “The Transport Layer Security (TLS) Protocol Version 1.1” (April 2006, Historic) as its specification. RFC 4346 has since been obsoleted by [RFC 5246](https://www.rfc-editor.org/rfc/rfc5246) (2008). As early as 2006, the TLS 1.1 specification [RFC 4346](https://www.rfc-editor.org/rfc/rfc4346) said TLS 1.1 implementations MUST NOT negotiate the export suites, which include this one. It can only be negotiated in SSL 3.0, TLS 1.0. [RFC 7568](https://www.rfc-editor.org/rfc/rfc7568) (2015) deprecated SSL 3.0 and [RFC 8996](https://www.rfc-editor.org/rfc/rfc8996) (2021) deprecated TLS 1.0 and TLS 1.1, so no protocol version still in good standing allows it. [RFC 10015](https://www.rfc-editor.org/rfc/rfc10015) (2026) now says clients MUST NOT offer and servers MUST NOT select FFDHE suites in (D)TLS 1.2, and IANA changed this entry's Recommended value to D.

## How to test whether a server accepts it

OpenSSL 3.5 cannot offer TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, so openssl s_client can't test it directly; use a scanner that implements the suite itself.

nmap's ssl-enum-ciphers script connects repeatedly, trying one suite at a time, and lists every suite the server accepts with a grade from A to F. Look for TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA in its output:

```bash
nmap --script ssl-enum-ciphers -p 443 example.com
```

To decode a name or hex code, use the [cipher suite lookup](https://ssl.sh/tools/cipher-suite-lookup/); the [SSL checker](https://ssl.sh/tools/ssl-checker/) shows which protocol versions a live server accepts and the cipher suite it negotiates.

## FAQ

### Is TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA secure?

No. ssl.sh rates it insecure. Export-grade cryptography (40/56-bit keys), broken since the 1990s and exploited by FREAK and Logjam. [RFC 10015](https://www.rfc-editor.org/rfc/rfc10015) (2026) now says clients MUST NOT offer and servers MUST NOT select FFDHE suites in (D)TLS 1.2, and IANA changed this entry's Recommended value to D.

### Can TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA be used with TLS 1.3?

No. It only works with SSL 3.0, TLS 1.0, all deprecated. TLS 1.3 uses its own suites such as [TLS_AES_128_GCM_SHA256](https://ssl.sh/ciphers/tls-aes-128-gcm-sha256/).

### How do I disable TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA in Nginx or Apache?

There is nothing to disable: OpenSSL 3.5, which Nginx and Apache httpd normally use, does not implement TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, so they cannot negotiate it.

### Which clients and libraries still support TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA?

Only after explicit configuration: Java 21 (SunJSSE). Not supported: OpenSSL 3.5, GnuTLS, BoringSSL, Go crypto/tls, NSS 3.133, Firefox, Windows Schannel (Windows 11 / Server 2022) and rustls 0.23.46.