TLS handshake failures after removal of CBC-mode ciphers
Last edited: 10/14/2026
Supabase 最早会在 2026 年 11 月 10 日从项目 API 的 TLS 1.2 中移除四个密码分组链接（CBC）模式的加密套件。移除后，只支持这些加密方式的客户端将无法连接 Auth、数据 API、存储、实时或者 Edge Functions。此次移除适用于 <project_ref>.supabase.co 以及自定义域名。
🌐 Supabase will remove four cipher block chaining (CBC) mode cipher suites from TLS 1.2 on project APIs, on November 10, 2026 at the earliest. After the removal, clients that support only these ciphers can't connect to Auth, the Data API, Storage, Realtime, or Edge Functions. The removal applies to <project_ref>.supabase.co and to custom domains.
直接的 Postgres 连接、通过连接池的连接以及管理 API 都不受影响。
🌐 Direct Postgres connections, connections through the pooler, and the Management API aren't affected.
症状 #
🌐 Symptoms
客户端在 TLS 握手期间失败，在发送任何 HTTP 请求之前，所以请求不会出现在你项目的 API 日志中。使用最新设备的客户端仍然可以正常工作。
🌐 The client fails during the TLS handshake, before it sends any HTTP request, so the request doesn't appear in your project's API logs. Clients on up-to-date devices keep working.
错误信息取决于客户端：
🌐 The error message depends on the client:
| 客户端 | 错误信息 |
|---|---|
| 基于 OpenSSL 的客户端，例如 curl、Node.js 或 PHP | sslv3 alert handshake failure |
| 浏览器 | ERR_SSL_VERSION_OR_CIPHER_MISMATCH |
| Windows PowerShell 和 .NET 框架 | The request was aborted: Could not create SSL/TLS secure channel. |
| Java | javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure |
| 苹果平台 | An SSL error has occurred and a secure connection to the server cannot be made. |
原因 #
🌐 Cause
客户端无法使用 TLS 1.3，它和项目 API 共享的唯一 TLS 1.2 密码套件都是已经被移除的 CBC 模式套件。这个错误通常意味着客户端运行的是已终止支持的软件，比如不再接收更新的操作系统或者嵌入式设备。有关已移除和支持的密码套件的完整列表，请参阅 项目 API 的 TLS。
🌐 The client can't use TLS 1.3, and the only TLS 1.2 cipher suites it shares with project APIs are the removed CBC-mode ones. This error usually means the client runs end-of-life software, such as an unsupported operating system or an embedded device that no longer receives updates. For the full list of removed and supported cipher suites, see TLS for project APIs.
如果你在移除日期之前看到这些错误，那就不是因为 CBC 模式被移除了造成的。比如说，项目的 API 不支持 TLS 1.0 或 TLS 1.1，所以只能使用这些版本的客户端根本无法连接。
🌐 If you see these errors before the removal date, the CBC-mode removal isn't the cause. For example, project APIs don't support TLS 1.0 or TLS 1.1, so clients limited to those versions can't connect at all.
诊断客户 #
🌐 Diagnose the client
检查你的应用实际使用的 TLS 配置：它的操作系统、运行时和 TLS 库版本，以及你代码或配置中的任何 TLS 版本或密码套件设置。使用 TLS 1.3 连接的客户端不会受到移除影响，无论它支持哪些 TLS 1.2 密码套件。
🌐 Check the TLS configuration your application actually uses: its operating system, runtime, and TLS library versions, and any TLS version or cipher suite settings in your code or configuration. A client that connects with TLS 1.3 isn't affected by the removal, whatever TLS 1.2 cipher suites it supports.
修一下客户端 #
🌐 Fix the client
把客户端的操作系统、运行时或 TLS 库更新到支持 TLS 1.3 或受支持的 TLS 1.2 密码套件的版本。
🌐 Update the client's operating system, runtime, or TLS library to a version that supports TLS 1.3 or a supported TLS 1.2 cipher suite.
如果你无法更新客户端，可以通过你控制的代理转发它的流量。代理接受客户端的加密套件，并通过受支持的 TLS 连接将请求转发到 Supabase。
🌐 If you can't update a client, route its traffic through a proxy that you control. The proxy accepts the client's ciphers and forwards requests to Supabase over a supported TLS connection.
如果你不能更新客户端或添加代理，提交一个支持请求。
🌐 If you can't update the client or add a proxy, open a support ticket.