Deprecating the DHE cipher suite for TLS connections
By Steven Van ·
Vercel drops the legacy DHE-RSA-AES256-GCM-SHA384 cipher suite on June 30th, 2026, affecting older TLS 1.2 clients.
Vercel is dropping support for the legacy DHE-RSA-AES256-GCM-SHA384 cipher suite on June 30th, 2026. The cipher sees little use from modern browsers but can still show up in automated systems, security scanners, and HTTP clients with non-standard TLS configurations.
After that date, clients connecting over TLS 1.2 will need to support one of six remaining cipher suites: ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, or ECDHE-RSA-CHACHA20-POLY1305. Modern clients and TLS 1.3 connections are unaffected. Vercel recommends that anyone running integrations or automated systems connecting to a Vercel-hosted domain over TLS 1.2 check that their client supports one of these suites, noting that modern TLS libraries do so by default. Full details are in the announcement.