infoDeprecation

Clerk phases out CBC cipher suites

Announced
16 Jul 2026
Effective
18 Jan 2027 · in 71 days
Source
the vendor’s own page · last checked 29 Sept 2026

What breaks

This only affects clients that cannot negotiate modern cipher suites.

  • TLS handshakes to Clerk-managed subdomains (Frontend API, Account Portal) will fail for clients that can only negotiate a CBC-mode cipher
  • Any client without support for AEAD ciphers like AES-GCM or ChaCha20-Poly1305 loses the ability to connect once its subdomain rotates

What to do

Most applications will not be affected, since modern browsers, mobile OSes, and server runtimes already prefer AEAD ciphers.

  • Nothing to do if your clients already negotiate modern (non-CBC) cipher suites
  • Contact support@clerk.com if you need continued CBC support

What the vendor said

Starting January 18, 2027, Clerk will stop supporting CBC-mode SSL/TLS cipher suites on Clerk-managed subdomains such as the Frontend API and Account Portal. The rollout happens gradually as certificates are renewed, since Clerk certificates are valid for 90 days, so all affected subdomains will be moved over within a few months of the start date.

Watching more than one repository?

The team plan is not open yet.

No account, and no repository read. We store the address and the date, and nothing else — see privacy.