TLS_RSA_WITH_AES_128_GCM_SHA256
A legacy TLS 1.2 cipher suite with static RSA key exchange and no forward secrecy, kept by browsers for old servers.
What it is
TLS_RSA_WITH_AES_128_GCM_SHA256 (code 0x009C) is a TLS 1.2 cipher suite defined in RFC 5288. It uses static RSA key exchange: the client encrypts the premaster secret with the server's RSA public key. Records are protected with AES-128 in GCM mode, and SHA-256 is used by the PRF.
Static RSA has no forward secrecy. Anyone who later obtains the server's private key can decrypt every recorded session that used it. RSA key exchange has also been the target of padding oracle attacks such as ROBOT. For these reasons RFC 9325 says not to use it, and TLS 1.3 removed RSA key exchange completely.
The encryption part, AES-GCM, is still sound. The weakness is only in how the keys are agreed. Clients keep offering the suite near the end of their lists so they can still reach old servers that support nothing better.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 8 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Chrome still offers this suite near the end of its list, and so do curl, curl_cffi, curl-impersonate, Node.js fetch and PHP Guzzle. Python requests, httpx and Go net/http do not send it in our measurements, because their default cipher lists drop static RSA key exchange. Its absence is one of the easiest ways to tell a Python or Go client from a browser in the JA3 cipher list.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for TLS_RSA_WITH_AES_128_GCM_SHA256 in the TLS details.
Run the TLS fingerprint test