Supabase: An outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIs
Component: supabase · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
Supabase is removing four outdated CBC-mode TLS 1.2 cipher suites on project HTTP APIs starting November 10, 2026. Clients running on end-of-life operating systems or legacy embedded devices that do not support modern GCM or ChaCha20 ciphers will lose HTTP API access.
💻 Software Engineers & Devs
Audit and update any legacy client applications, old browsers, or embedded devices connecting over HTTPS to ensure they support modern TLS 1.2 GCM/ChaCha20 ciphers or TLS 1.3.
📊 Product & Engineering Leads
Evaluate if any user base segment relies on outdated, unmaintained hardware or legacy operating systems that might be locked out of your application.
⚙️ DevOps & Security
Verify that custom domain and standard project HTTP API client environments have up-to-date TLS libraries ahead of the November 2026 removal date.