# TLS_FALLBACK_SCSV cipher suite

> TLS_FALLBACK_SCSV (0x56,0x00) is a signaling cipher suite value (SCSV), not a real cipher suite: clients put it in the ClientHello to signal a capability, and it never gets negotiated.

Source: https://ssl.sh/ciphers/tls-fallback-scsv/
Last updated: 2026-11-10

TLS_FALLBACK_SCSV (0x56,0x00) is a signaling cipher suite value (SCSV), not a real cipher suite: clients put it in the ClientHello to signal a capability, and it never gets negotiated.

| Field | Value |
|---|---|
| IANA | TLS_FALLBACK_SCSV |
| Hex code | 0x56,0x00 |
| OpenSSL | Not available in OpenSSL 3.5 |
| GnuTLS | - |
| Key exchange | - |
| Authentication | - |
| Encryption | - |
| MAC | - |
| TLS versions | - |
| Rating | Signal only |
| IANA "Recommended" | N |
| References | RFC 7507 |

## What each component means

TLS_FALLBACK_SCSV (0x56,0x00) is a signal, not a cipher suite. A client that retries a failed handshake with a lower protocol version adds it to the cipher list; if the server supports a higher version than the one offered, it aborts with an inappropriate_fallback alert. [RFC 7507](https://www.rfc-editor.org/rfc/rfc7507) (2015) introduced it after [POODLE](https://ssl.sh/glossary/poodle/) abused such insecure fallbacks to push connections down to SSL 3.0. The RFC index now lists RFC 7507 as obsoleted by [RFC 8996](https://www.rfc-editor.org/rfc/rfc8996) (2021), which deprecated TLS 1.0 and 1.1; TLS 1.3 servers instead signal a downgrade in the last 8 bytes of ServerHello.random.

## Why this rating

- Signaling value only; it carries no algorithms and is never negotiated.

## History and standards status

TLS_FALLBACK_SCSV (0x56,0x00) is registered in the IANA TLS Cipher Suites registry with [RFC 7507](https://www.rfc-editor.org/rfc/rfc7507), “TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks” (April 2015, Standards Track) as its specification. RFC 7507 has since been obsoleted by [RFC 8996](https://www.rfc-editor.org/rfc/rfc8996) (2021).

## How to test whether a server accepts it

Check that a server rejects insecure fallback: offer TLS 1.2 with the fallback signal to a server that supports TLS 1.3. A correct server aborts with an inappropriate fallback alert:

```bash
openssl s_client -connect example.com:443 -tls1_2 -fallback_scsv </dev/null
```

To decode a name or hex code, use the [cipher suite lookup](https://ssl.sh/tools/cipher-suite-lookup/); the [SSL checker](https://ssl.sh/tools/ssl-checker/) shows which protocol versions a live server accepts and the cipher suite it negotiates.

## FAQ

### Is TLS_FALLBACK_SCSV a real cipher suite?

No. It is a signaling cipher suite value: it carries no algorithms, is never selected by the server, and only tells the server something about the client. ssl.sh therefore does not rate it.

### Do I need to configure TLS_FALLBACK_SCSV in Nginx or Apache?

No. Clients add it automatically and OpenSSL-based servers such as Nginx and Apache httpd recognise it without any directive; it doesn't appear in `ssl_ciphers` or `SSLCipherSuite` lists.

### Does TLS_FALLBACK_SCSV matter with TLS 1.3?

Less than it used to. TLS 1.3 has downgrade protection built into ServerHello.random, and with TLS 1.0 and 1.1 deprecated there is little to fall back to; clients that no longer retry with older versions don't send it.