TLS_RSA_WITH_AES_256_CBC_SHA
An old TLS cipher suite with static RSA key exchange, AES-256 in CBC mode and SHA-1. It is the last suite in Chrome's list.
What it is
TLS_RSA_WITH_AES_256_CBC_SHA (code 0x0035) first appeared in RFC 3268 and is listed in the TLS 1.2 specification, RFC 5246. It uses static RSA key exchange, AES with a 256-bit key in CBC mode, and HMAC-SHA1 for integrity.
It has every weakness of its era: no forward secrecy because of static RSA, CBC with MAC-then-encrypt, and SHA-1. RFC 9325 advises against static RSA, and against CBC suites unless encrypt_then_mac is negotiated. TLS 1.3 removed all such suites.
Clients keep it only for compatibility with very old servers, and it is usually the very last entry of the list.
Its code, 0x0035, is very old by TLS standards. Low two-byte codes generally mark early suites, while the modern ECDHE suites sit in the 0xC0xx and 0xCCxx ranges and the TLS 1.3 suites in 0x13xx. Servers that still accept it should check whether any real visitor needs it.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 8 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
In our capture it is Chrome's 15th and last suite, and the same for curl_cffi and curl-impersonate chrome116. Debian curl and Guzzle send it 29th, macOS curl 18th, and Node.js fetch 35th. Python requests, httpx and Go net/http do not send it, since their defaults drop static RSA.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for TLS_RSA_WITH_AES_256_CBC_SHA in the TLS details.
Run the TLS fingerprint test