Weak TLS Cipher Suites Usable in Auth0 Endpoints

The Auth0 service allows the use of certain cipher suites that no longer provide adequate security characteristics and, for that reason, are sometimes referred to as weak cipher suites. More specifically, the following list of cipher suites is currently allowed by default, and security checks performed against service endpoints or Universal Login pages may flag this situation:

• 0xC0,0x09 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
• 0xC0,0x0A - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
• 0xC0,0x23 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• 0xC0,0x24 - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
• 0xC0,0x13 - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• 0xC0,0x14 - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
• 0xC0,0x27 - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• 0xC0,0x28 - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• 0x00,0x9C - TLS_RSA_WITH_AES_128_GCM_SHA256
• 0x00,0x2F - TLS_RSA_WITH_AES_128_CBC_SHA
• 0x00,0x9D - TLS_RSA_WITH_AES_256_GCM_SHA384
• 0x00,0x35 - TLS_RSA_WITH_AES_256_CBC_SHA
• 0x00,0x3C - TLS_RSA_WITH_AES_128_CBC_SHA256
• 0x00,0x3D - TLS_RSA_WITH_AES_256_CBC_SHA256

An exception is the Canada region (CA-1) public cloud environment, which no longer supports any of the ciphers listed above.

• Transport Layer Security (TLS)
• TLS Cipher Suites

Due to historical reasons related to backward compatibility with older devices, the cipher suites in question have remained usable for an extended period. However, as of December 2025, the cipher suites listed above are deprecated and have a scheduled removal (end-of-life) towards the end of H1 2026.

There is no general approach to customizing available TLS cipher suites on a per-tenant basis. Until the end-of-life process completes, the deprecated cipher suites listed above will remain allowed by default across Auth0 tenants in applicable environments.

However, in specific scenarios, customers may have additional control over available cipher suites. For example, using a self-managed certificate custom domain implies a reverse proxy that terminates inbound TLS connections, thereby allowing the customization of all TLS aspects related to the traffic received over the custom domain.

Additionally, for private cloud customers, Auth0 will evaluate ad hoc requests to remove deprecated cipher suites ahead of the general end-of-life, provided the removal request pertains to all tenants and services within a private cloud environment.