TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
A TLS 1.2 cipher suite with ECDHE key exchange, an RSA certificate, AES-256-GCM encryption and SHA-384.
What it is
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (code 0xC030) is a TLS 1.2 cipher suite from RFC 5289. It combines ephemeral elliptic curve Diffie-Hellman key exchange, an RSA-signed server certificate, AES with a 256-bit key in Galois/Counter Mode, and SHA-384 as the hash for the TLS 1.2 PRF.
It is the 256-bit sibling of TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Both provide forward secrecy and authenticated encryption, so the choice between them is about key length and policy rather than about known weaknesses.
Some server configurations and compliance profiles prefer 256-bit suites, so servers configured that way pick this suite over the AES-128 variant. RFC 9325 lists it among the recommended TLS 1.2 suites. It only matters when TLS 1.2 is negotiated; with TLS 1.3 the TLS_AES_256_GCM_SHA384 suite covers the same role.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 12 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
All measured clients send it. OpenSSL-based clients such as Python requests, httpx, Guzzle and Debian curl put it 5th, right after the TLS 1.3 suites and the ECDSA variant, while Chrome, curl_cffi and macOS curl send it 7th and Go net/http 4th. As with every TLS 1.2 suite, the position feeds into the JA3 hash.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 in the TLS details.
Run the TLS fingerprint test