I'm trying to setup a custom order of TLS cipher suites according to this Microsoft list, on Windows Server 2022 but the outcome is not the one that I was expecting.

After using the powershell to disable a bunch, and set a preferred order this is what I have:

PS C:\Windows\system32> Get-TlsCipherSuite | Format-Table -Property CipherSuite, Name

CipherSuite Name

   4866 TLS_AES_256_GCM_SHA384
   4865 TLS_AES_128_GCM_SHA256
      0 TLS_CHACHA20_POLY1305_SHA256

On the other machine, if I check the Windows host what are the cipher suites in use, the output list is shorten, not displaying all the TLS 1.2 that I set. The missing ones are:


And here is the output from OpenSSL

sslscan somedomain.com Version: 2.0.15-static OpenSSL 1.1.1q-dev xx XXX xxxx

Connected to

Testing SSL server somedomain.com on port 443 using SNI name somedomain.com

SSL/TLS Protocols:

  • SSLv2 disabled
  • SSLv3 disabled
  • TLSv1.0 disabled
  • TLSv1.1 disabled
  • TLSv1.2 enabled
  • TLSv1.3 enabled

TLS Fallback SCSV: Server does not support TLS Fallback SCSV

TLS renegotiation: Session renegotiation not supported

TLS Compression: Compression disabled


  • TLSv1.3 not vulnerable to heartbleed
  • TLSv1.2 not vulnerable to heartbleed

Supported Server Cipher(s):

  • Preferred TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253
  • Accepted TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253
  • Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253
  • Preferred TLSv1.2 256 bits ECDHE-ECDSA-AES256-GCM-SHA384 Curve P-384 DHE 384
  • Accepted TLSv1.2 128 bits ECDHE-ECDSA-AES128-GCM-SHA256 Curve 25519 DHE 253

Server Key Exchange Group(s):

  • TLSv1.3 128 bits secp256r1 (NIST P-256)
  • TLSv1.3 192 bits secp384r1 (NIST P-384)
  • TLSv1.3 128 bits x25519
  • TLSv1.2 128 bits secp256r1 (NIST P-256)

SSL Certificate:

  • Signature Algorithm: sha256WithRSAEncryption
  • ECC Curve Name: prime256v1
  • ECC Key Strength: 128

Is anything else that I have to do in order to have the full list of cipher suites ordered using the powershell command? On the other hand, using the Let's Encrypt Certificate I used the ECDSA P-256 as a CSR signing algorithm but what I see, at least for me, looks odd saying sha256WithRSAEncryption, RSA encryption but no TLS cipher? Totally confused.
Not sure, I am not a crypto engineer but I really appreciate any help on this to make things right in place.


1 Answer 1


On the other machine, if I check the Windows host what are the cipher suites in use, ...

I have no idea what you do did here exactly, since you do not give any command etc you use. But what you show as missing are the ciphers with RSA authentication, which makes sense since you've used an ECDSA certificate.

sslscan ...Supported Server Cipher(s): ....

This looks to me like this matches what you've configured. It will of course not show any ciphers with RSA authentication since you've used an ECDSA certificate.

... looks odd saying sha256WithRSAEncryption, RSA encryption but no TLS cipher?

This is about the algorithms used by the issuer of the certificate to sign the certificate. It is not about the key in the certificate itself which clearly is ECDSA as shown (ECC Curve Name: prime256v1, ECC Key Strength: 128)

  • to disable not wanted cipher suites I used this: [link]learn.microsoft.com/en-us/powershell/module/tls/… as for prioritizing this [link]learn.microsoft.com/en-us/powershell/module/tls/…. According to Mozilla best practices [link]wiki.mozilla.org/Security/Server_Side_TLS[link] I was expecting to have the above powershell list of supported cipher suites, but instead shows less.
    – cadobe
    Dec 20, 2022 at 13:02
  • What I understood from your comment is that the sslscan linux command against an SSL host will give you the supported cipher suites by the CERTIFICATE itself, not the machine as a server. Am I correct? If so, how do I figure about a proper settings that will correlate my entire/desired cipher suites list to be used on a certificate? In other words, what would be the right settings for a certificate in order to use any from my list on a client machine?
    – cadobe
    Dec 20, 2022 at 13:03
  • @cadobe: sslscan and similar tools can not query the server for a list of supported ciphers - this is not how TLS works. Instead they can only check if a specific cipher works for successful establishing a TLS handshake. Since your server has only an ECDSA certificate only these ciphers will work and thus only these get reported. If you want to have also the RSA ciphers reported you need to configure also a RSA certificate (i.e. have both ECDSA and RSA on same domain) - no idea if your server supports both at the same time. Dec 20, 2022 at 20:03
  • Re the cert signature: LetsEncrypt can issue certs under an EC(DSA) intermediate 'E1' only if the leaf key is EC and you have specifically 'allowlisted' your account; see letsencrypt.org/certificates . OP presumably didn't, and thus got an EC(DSA) cert issued under the RSA intermediate 'R3'. Dec 21, 2022 at 1:54
  • @Steffen, thumbs up. Thanks a lot for clarifications. Makes much more sense to me now.
    – cadobe
    Dec 21, 2022 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .