# TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA cipher suite

> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xC0,0x09): ECDHE/ECDSA · AES-128-CBC · TLS 1.0, TLS 1.1, TLS 1.2. ssl.sh rating: Weak. OpenSSL/GnuTLS names and Nginx/Apache config.

Source: https://ssl.sh/ciphers/tls-ecdhe-ecdsa-with-aes-128-cbc-sha/
Last updated: 2026-11-10

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xC0,0x09) is a cipher suite for TLS 1.0, TLS 1.1, TLS 1.2: ECDHE key exchange, ECDSA authentication, AES-128-CBC encryption and SHA1 message authentication. ssl.sh rates it Weak.

| Field | Value |
|---|---|
| IANA | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
| Hex code | 0xC0,0x09 |
| OpenSSL | ECDHE-ECDSA-AES128-SHA |
| GnuTLS | TLS_ECDHE_ECDSA_AES_128_CBC_SHA1 |
| Key exchange | ECDHE |
| Authentication | ECDSA |
| Encryption | AES-128-CBC |
| MAC | SHA1 |
| TLS versions | TLS 1.0, TLS 1.1, TLS 1.2 |
| Rating | Weak |
| IANA "Recommended" | N |
| References | RFC 8422 |

## What each component means

A [cipher suite](https://ssl.sh/glossary/cipher-suite/) names the algorithms a client and server agree on in one handshake. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA combines ECDHE key exchange, ECDSA authentication, AES-128-CBC encryption and SHA1 integrity protection. Each part is explained below with its known weaknesses; for the bigger picture see [how cipher suites work](https://ssl.sh/learn/cipher-suites/).

Key exchange: [ECDHE](https://ssl.sh/glossary/ecdhe/), ephemeral elliptic-curve Diffie-Hellman. Client and server create a fresh key pair on a named curve such as X25519 or P-256 for every handshake and discard it afterwards. Because the session keys never depend on the server's long-term private key alone, stealing that key later does not decrypt recorded traffic; this property is [forward secrecy](https://ssl.sh/glossary/forward-secrecy/). ECC cipher suites were first specified in [RFC 4492](https://www.rfc-editor.org/rfc/rfc4492) (2006); the current definition is [RFC 8422](https://www.rfc-editor.org/rfc/rfc8422) (2018).

Authentication: [ECDSA](https://ssl.sh/glossary/ecdsa/). The server needs an elliptic-curve certificate, usually P-256 or P-384, and signs the key-exchange parameters with it. A P-256 key gives about 128-bit security, comparable to a 3072-bit RSA key at a fraction of the size, and [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022) recommends P-256 for ECDSA in TLS. A server with only an RSA certificate cannot negotiate this suite, which is why many sites deploy an RSA and an ECDSA certificate side by side.

Encryption: AES with a 128-bit key, the 128-bit block cipher of FIPS 197 (2001). Most server and phone CPUs have AES instructions (AES-NI on x86, the ARMv8 cryptography extensions), which make it fast and avoid the cache-timing leaks of table-based software implementations.

Mode: CBC with MAC-then-encrypt. TLS 1.2 and earlier compute the HMAC over the plaintext, then pad and encrypt, so a receiver has to decrypt before it can check integrity. That ordering produced a long run of padding-oracle attacks: [BEAST](https://ssl.sh/glossary/beast/) (CVE-2011-3389) against TLS 1.0's predictable IVs, Lucky Thirteen (CVE-2013-0169, 2013), which times the MAC check, and [POODLE](https://ssl.sh/glossary/poodle/) (CVE-2014-3566, 2014) against SSL 3.0's unchecked padding. [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022) says CBC suites SHOULD NOT be used unless the encrypt_then_mac extension ([RFC 7366](https://www.rfc-editor.org/rfc/rfc7366)) is also negotiated.

Integrity: HMAC-SHA1. [SHA-1](https://ssl.sh/glossary/sha-1/) collisions are practical (SHAttered, 2017), but HMAC does not rely on collision resistance, so HMAC-SHA1 record MACs are not considered broken; this suite's weak points lie elsewhere. When TLS 1.2 is negotiated, keys are derived with the SHA-256 PRF, which [RFC 5246](https://www.rfc-editor.org/rfc/rfc5246) (2008) applies to every cipher suite defined before it.

## Why this rating

- CBC mode with a separate MAC (MAC-then-encrypt), the construction behind padding-oracle attacks such as Lucky Thirteen; prefer an AEAD cipher.

## Which TLS libraries support it

Support for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA as read from each library's own source code or official documentation on 2026-11-10. “Enabled by default” means the library negotiates it with no configuration; “off by default” means it is implemented but has to be switched on.

| Library | Status | Details |
|---|---|---|
| OpenSSL 3.5 | Implemented | cipher string `ECDHE-ECDSA-AES128-SHA` |
| GnuTLS | Implemented | name `TLS_ECDHE_ECDSA_AES_128_CBC_SHA1`; minimum protocol `SSL 3.0` |
| BoringSSL | Enabled by default | - |
| Go crypto/tls | Enabled by default | returned by tls.CipherSuites() |
| NSS 3.133 | Enabled by default | NSS library default |
| Firefox | Supported, off by default | about:config pref `security.ssl3.ecdhe_ecdsa_aes_128_sha` |
| Java 21 (SunJSSE) | Enabled by default | - |
| Windows Schannel (Windows 11 / Server 2022) | Enabled by default | - |
| rustls 0.23.46 | Not supported | - |

Enabled by default in 5 of the 9 libraries tracked here: BoringSSL, Go crypto/tls, NSS 3.133, Java 21 (SunJSSE) and Windows Schannel (Windows 11 / Server 2022). Supported but off by default in: Firefox. Also implemented by: OpenSSL 3.5 and GnuTLS.

NSS shows the library's own defaults; Firefox switches every NSS suite off at start-up and re-enables only those with a security.ssl3.* or security.tls13.* preference. Java defaults are derived from the jdk.tls.disabledAlgorithms value Oracle documents for JDK 21, which later updates may extend. The OpenSSL and GnuTLS rows only show whether the suite is implemented.

- [BoringSSL — ssl/ssl_cipher.cc (main)](https://boringssl.googlesource.com/boringssl/+/refs/heads/main/ssl/ssl_cipher.cc) (2026-11-10)
- [Go — src/crypto/tls/cipher_suites.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go) (2026-11-10)
- [Go — src/crypto/tls/defaults.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/defaults.go) (2026-11-10)
- [NSS — lib/ssl/ssl3con.c (as vendored in Firefox)](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/lib/ssl/ssl3con.c) (2026-11-10)
- [NSS — TAG-INFO](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/TAG-INFO) (2026-11-10)
- [Firefox — security/manager/ssl/nsNSSComponent.cpp](https://github.com/mozilla-firefox/firefox/blob/main/security/manager/ssl/nsNSSComponent.cpp) (2026-11-10)
- [Firefox — modules/libpref/init/StaticPrefList.yaml](https://github.com/mozilla-firefox/firefox/blob/main/modules/libpref/init/StaticPrefList.yaml) (2026-11-10)
- [Oracle — JDK 21 Providers Documentation: SunJSSE Cipher Suites](https://docs.oracle.com/en/java/javase/21/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2) (2026-11-10)
- [Oracle — JDK 21 JSSE Reference Guide: jdk.tls.disabledAlgorithms](https://docs.oracle.com/en/java/javase/21/security/java-secure-socket-extension-jsse-reference-guide.html) (2026-11-10)
- [Microsoft Learn — TLS Cipher Suites in Windows 11](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11) (2026-11-10)
- [Microsoft Learn — TLS Cipher Suites in Windows Server 2022](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022) (2026-11-10)
- [docs.rs — rustls 0.23.46 crypto::aws_lc_rs (default provider)](https://docs.rs/rustls/0.23.46/src/rustls/crypto/aws_lc_rs/mod.rs.html) (2026-11-10)

## History and standards status

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xC0,0x09) is registered in the IANA TLS Cipher Suites registry with [RFC 8422](https://www.rfc-editor.org/rfc/rfc8422), “Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier” (August 2018, Standards Track) as its specification. RFC 8422 has since been obsoleted by [RFC 9846](https://www.rfc-editor.org/rfc/rfc9846) (2026). [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022), part of BCP 195, says CBC suites SHOULD NOT be used unless encrypt_then_mac is negotiated. The registry marks it N, which per [RFC 8447](https://www.rfc-editor.org/rfc/rfc8447) (2018) means it either hasn't been through the IETF consensus process, has limited applicability or is meant only for specific use cases, not necessarily that it is flawed.

## Nginx / Apache

Disable

```nginx
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:!ECDHE-ECDSA-AES128-SHA';
```

```apache
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:!ECDHE-ECDSA-AES128-SHA
```


## How to test whether a server accepts it

Offer only TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA with openssl s_client; if the handshake completes, the server accepts it:

```bash
openssl s_client -connect example.com:443 -tls1_2 -cipher ECDHE-ECDSA-AES128-SHA </dev/null
```

nmap's ssl-enum-ciphers script connects repeatedly, trying one suite at a time, and lists every suite the server accepts with a grade from A to F. Look for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA in its output:

```bash
nmap --script ssl-enum-ciphers -p 443 example.com
```

To decode a name or hex code, use the [cipher suite lookup](https://ssl.sh/tools/cipher-suite-lookup/); the [SSL checker](https://ssl.sh/tools/ssl-checker/) shows which protocol versions a live server accepts and the cipher suite it negotiates.

## FAQ

### Is TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA secure?

Only with caveats: ssl.sh rates it weak. CBC mode with a separate MAC (MAC-then-encrypt), the construction behind padding-oracle attacks such as Lucky Thirteen; prefer an AEAD cipher. [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022), part of BCP 195, says CBC suites SHOULD NOT be used unless encrypt_then_mac is negotiated.

### Can TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA be used with TLS 1.3?

No. TLS 1.3 has its own suites that name only the AEAD and the hash, and TLS 1.2 suites can't be used in a TLS 1.3 handshake. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA works with TLS 1.0, TLS 1.1, TLS 1.2. The closest TLS 1.3 suite is [TLS_AES_128_GCM_SHA256](https://ssl.sh/ciphers/tls-aes-128-gcm-sha256/), which TLS 1.3 combines with a separately negotiated key exchange such as X25519.

### How do I disable TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA in Nginx or Apache?

Exclude it by its OpenSSL name: append `!ECDHE-ECDSA-AES128-SHA` to `ssl_ciphers` in Nginx or to `SSLCipherSuite` in Apache httpd. Listing only the suites you want, as in the snippet above, works even better. Reload the server and repeat the openssl s_client test to confirm the handshake now fails.

### Which clients and libraries still support TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA?

Out of the box: BoringSSL, Go crypto/tls, NSS 3.133, Java 21 (SunJSSE) and Windows Schannel (Windows 11 / Server 2022). Only after explicit configuration: Firefox. Implemented, default state not tracked here: OpenSSL 3.5 and GnuTLS. Not supported: rustls 0.23.46.