May 28, 2026

Default Global Policies for Security Protocols and Cipher Suites

Global acceptance and proposal policies activate certain security protocols and cipher suites by default.

Security-related settings are provided in Horizon LDAP under the object path cn=common,ou=global,ou=properties,dc=vdi,dc=horizon,dc=internal.

Default Security Protocols	Default Cipher Suites	Default Signature Schemes
`TLS 1.3` Note: This is the preferred protocol starting with the Horizon 2312.1 release.	TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 (2503 and later)	rsa_pss_rsae_sha512 rsa_pss_rsae_sha384 rsa_pss_rsae_sha256 rsa_pss_pss_sha512 rsa_pss_pss_sha384 rsa_pss_pss_sha256 rsa_pkcs1_sha512 rsa_pkcs1_sha384 rsa_pkcs1_sha256 rsa_pkcs1_sha1
`TLS 1.2`	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (2503 and later) TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	rsa_pss_rsae_sha512 rsa_pss_rsae_sha384 rsa_pss_rsae_sha256 rsa_pss_pss_sha512 rsa_pss_pss_sha384 rsa_pss_pss_sha256 rsa_pkcs1_sha512 rsa_pkcs1_sha384 rsa_pkcs1_sha256 rsa_pkcs1_sha1

Default Security Protocols	Default Cipher Suites	Default Signature Schemes
`TLS 1.3` Note: This is the preferred protocol starting with the Horizon 2312.1 release.	TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 (2503 and later)	rsa_pss_rsae_sha512 rsa_pss_rsae_sha384 rsa_pss_rsae_sha256 rsa_pss_pss_sha512 rsa_pss_pss_sha384 rsa_pss_pss_sha256 rsa_pkcs1_sha512 rsa_pkcs1_sha384 rsa_pkcs1_sha256 rsa_pkcs1_sha1 ecdsa_secp521r1_sha512 ecdsa_secp384r1_sha384 ecdsa_secp256r1_sha256
`TLS 1.2`	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (2503 and later) TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	rsa_pss_rsae_sha512 rsa_pss_rsae_sha384 rsa_pss_rsae_sha256 rsa_pss_pss_sha512 rsa_pss_pss_sha384 rsa_pss_pss_sha256 rsa_pkcs1_sha512 rsa_pkcs1_sha384 rsa_pkcs1_sha256 rsa_pkcs1_sha1 ecdsa_secp521r1_sha512 ecdsa_secp384r1_sha384 ecdsa_secp256r1_sha256

Default Named Groups
secp384r1 secp256r1 secp521r1 ffdhe2048 ffdhe3072 ffdhe4096 ffdhe6144 ffdhe8192

Note: In FIPS mode, only GCM cipher suites and TLS 1.2 are activated.

Was this page helpful?

Provide feedback for this topic