NewsEditorialSource: Supabase
Supabase plans to remove four TLS 1.2 cipher suites from project HTTP APIs
Supabase announced on October 12, 2026, that it plans to remove four Transport Layer Security (TLS) 1.2 cipher suites no earlier than November 10, 2026. The change covers project HTTP APIs on supabase.co project addresses and custom domains, including Auth, Data API, Storage, Realtime and Edge Functions. Direct Postgres connections, pooler connections, the Management API and self-hosted deployments are excluded; TLS 1.3 remains unchanged. Supabase cited security weaknesses and scanner warnings involving the four cipher block chaining suites. According to its changelog, fewer than 0.0001% of connections negotiated those suites over the preceding 30 days.
Why it matters
Supabase’s TLS documentation says clients will fail to connect if they cannot use TLS 1.3 and their only shared TLS 1.2 cipher suites are being removed. Developers should check deployed runtimes, TLS libraries and explicit cipher settings, then update affected components and test their applications. A successful connection today does not establish compatibility after removal. Teams unable to update in time should contact support; the rollout date remains unsettled because Supabase says customer feedback could prompt a postponement.
Attribution
Sources
- SupabaseAn outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIsSource published (UTC)
- SupabaseTLS for project APIs
Read the original source for full details and context.