An outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIs

What is being deprecated#

Most users won't notice any change. Starting November 10, 2026 at the earliest, Supabase will stop offering some outdated TLS configurations on project HTTP APIs (<ref>.supabase.co and custom domains). Users on old, unsupported operating systems, or embedded devices that haven't been updated, may lose access if their device only supports the configurations being removed.

The configurations being removed are four CBC-mode TLS 1.2 cipher suites. Cipher suites determine how a connection is encrypted. These older suites have known security weaknesses and often trigger warnings in security scans. We plan to stop offering these ciphers on TLS 1.2:

• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (ECDHE-ECDSA-AES128-SHA256)
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ECDHE-RSA-AES128-SHA256)
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (ECDHE-ECDSA-AES256-SHA384)
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ECDHE-RSA-AES256-SHA384)

Supabase has only supported TLS 1.2 and 1.3 for several years. There is no change for TLS 1.3.

Auth, the Data API, Storage, Realtime, and Edge Functions are all sub-routes of the Supabase HTTP API, so all five are affected. Direct Postgres connections, pooler connections, and the Management API are not.

Timeline#

Owners of projects that received connections using these deprecated ciphers are being contacted directly with details about the potential impact to their project. If you have any concerns about the impact to your project, please open a support ticket.

What to migrate to#

In the past 30 days, fewer than 0.0001% of connections to Supabase projects negotiated these ciphers, so we expect little to no impact. Devices that only support them are running end-of-life software, such as old operating system installations or embedded products that no longer get updates.

The ciphers offered on TLS 1.2 going forward are:

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (ECDHE-ECDSA-AES128-GCM-SHA256)
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (ECDHE-ECDSA-CHACHA20-POLY1305)
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ECDHE-RSA-AES128-GCM-SHA256)
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ECDHE-RSA-CHACHA20-POLY1305)
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (ECDHE-ECDSA-AES256-GCM-SHA384)
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ECDHE-RSA-AES256-GCM-SHA384)

Migration steps#

1. Find any client that connects to your project over HTTPS and runs on an end-of-life operating system, an old browser, or an embedded device.
2. Update that client's operating system or TLS library to a supported version so it supports at least one of the ciphers listed above, or TLS 1.3. Your preferred AI agent or the community around your tech stack may be able to help.
3. If you're concerned about the impact on your users or need help preparing, open a support ticket and tell us which client and ciphers it needs.

Read more in the TLS docs.