Security Update: Discontinuing weak TLS cipher suites
Hello everyone,
This post is about Zoho's ongoing measures to strengthen security across all Data Centers.
Zoho is sunsetting weak TLS cipher suites across all its data centers. We are enforcing updates to the US, IN and EU data centers after completing this process in JP, AU, UK, SA, and CN data centers. This has been an ongoing process, as shared in our announcement, Security update: Retiring weak TLS cipher suites.
This post is about Zoho's ongoing measures to strengthen security across all Data Centers.
Zoho is sunsetting weak TLS cipher suites across all its data centers. We are enforcing updates to the US, IN and EU data centers after completing this process in JP, AU, UK, SA, and CN data centers. This has been an ongoing process, as shared in our announcement, Security update: Retiring weak TLS cipher suites.
What does retiring weak TLS cipher suites mean?
Weak TLS ciphers are old, insecure algorithms used to establish a connection with Zoho Desk servers. These HTTPS requests could come from outdated web browsers, and API clients.
Going forward, Zoho Desk will no longer support weak cipher suites.
What happens when weak ciphers are disabled?
Once weak cipher suites are disabled in the data centers, API clients that rely on them won't be able to establish secure connections with Zoho Desk. HTTPS requests using unsupported cipher suites will be rejected by our servers.
Action
Please make sure you use updated browsers as they support modern protocol versions such as TLS 1.2 and TLS 1.3 with stronger cipher suites. Most modern browsers and API clients automatically use strong and secure TLS cipher suites.
If you are using older browsers with weak TLS ciphers, please upgrade to the latest versions so you can continue accessing Zoho Desk and Help Center services without interruption.
How to check if you are using modern TLS?
Use our test endpoint to confirm if your system is using secure TLS cipher suites:
https://tlstest.zoho.com/api
You can use this link in two ways:
https://tlstest.zoho.com/api
You can use this link in two ways:
On your browser: Open the link directly in your web browser. This confirms whether your browser is establishing a secure connection using strong TLS cipher suites.
API clients: Use this link within your API clients (e.g., Python scripts, Java programs, Postman). Check the API response to confirm your application is using a strong TLS cipher suite.
Confirmation message
If everything is secure, you’ll get a message like:
{"status": 200, "tls_version": "TLSv1.3", "cipher": "TLS_AES_128_GCM_SHA256", "message": "Strong cipher"}
A 200 status code confirms your browser/API client is communicating successfully with a strong cipher.
If your system is using outdated encryption, you’ll see:
{"status": 400, "tls_version": "TLSv1.2", "cipher": "ECDHE-RSA-AES128-SHA256", "message": "Weak cipher"}
A 400 status code means your browser/API client is communicating with weak ciphers.
Please update your browsers and API clients by October 31, 2026, to ensure security and uninterrupted connectivity with Zoho Desk and Help Center services.
For any support or clarification, please email support@zohodesk.com.
Regards,
Lydia | Zoho Desk