TLS_RSA_WITH_AES_256_GCM_SHA384
A legacy TLS 1.2 cipher suite: static RSA key exchange without forward secrecy, with AES-256-GCM encryption.
What it is
TLS_RSA_WITH_AES_256_GCM_SHA384 (code 0x009D) is a TLS 1.2 cipher suite from RFC 5288. The client encrypts the premaster secret with the server's RSA key, and the records are protected with AES-256 in Galois/Counter Mode, with SHA-384 as the PRF hash.
The suite pairs strong encryption with a weak key exchange. Static RSA provides no forward secrecy, so a compromised server key exposes all past traffic, and it has been affected by Bleichenbacher-style padding oracle attacks. RFC 9325 recommends against static RSA suites, and TLS 1.3 does not have them at all.
Browsers and many libraries still list it after their ECDHE suites, purely as a fallback for very old servers. A modern server should never need to select it, and disabling it on the server side is safe for nearly all visitors.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 8 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Chrome still offers this suite near the end of its list, and so do curl, curl_cffi, curl-impersonate, Node.js fetch and PHP Guzzle. Python requests, httpx and Go net/http do not send it in our measurements, because their default cipher lists drop static RSA key exchange. Its absence is one of the easiest ways to tell a Python or Go client from a browser in the JA3 cipher list.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for TLS_RSA_WITH_AES_256_GCM_SHA384 in the TLS details.
Run the TLS fingerprint test