---
title: "Security specifications"
slug: "security-specifications-v6-6"
description: "Unlock the secrets of effective SEO with our expert tips, strategies, and insights to boost your website's visibility and drive traffic."
updated: 2026-09-16T16:55:25Z
published: 2026-09-16T16:55:25Z
canonical: "support.appgate.com/security-specifications-v6-6"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security specifications

| **Communications** TLSv1.3 is the default for all communications. If the peer does not support TLSv1.3, appliances fall back to TLSv1.2. Clients do not support this fallback. The tunnel protocol used for the VPN connection can be configured in [Sites > General](/v1/docs/configure-site-1). | ***Appliance to Appliance communication*** | nginx_peer_ciphers = TLS13-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 Mutual Certificate-based authentication with DN checking is used for communications between appliances (port 443) |
| --- | --- | --- |
| ***Client and Admin to Appliance communication (defaults)*** | nginx_client_ciphers = TLS13-AES256-GCM-SHA384:ECDHE-RSA-AES-256-GCM-SHA384 nginx client on 443 and 8443 |
| ***SSH to Appliance*** | Ciphers = AES-256-CTR, AES-192-CTR, AES-128-CTR |
| ***Client to Gateway tunnel*** | Cipher = TLS13-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 Mutual Certificate-based authentication with DN checking is used for communications |
| **Single Packet Authorization** | Cipher = AES-256-GCM |
| **Appliance certificate generated by a Controller** | SHA512 with RSA, keysize 4096 A Certificate Authority, Maximum number of intermediate CAs: 0, basicConstraints = critical, CA:true, pathlen:0, keyUsage = critical, digitalSignature, cRLSign, keyCertSign The CA cert is used for the controller-client authentication to communicate with appliances: extendedKeyUsage = clientAuth, serverAuth |
| **Claim and Entitlement token encryption** | Cipher = AES-256-CTR |
| **Database encryption** | Cipher = AES-256-CTR |
| **Backup file** | Cipher = GPG symmetric (AES-256-CFB) |
| **FIPS** | 6.4.1 and later Desktop Clients complies to FIPS 140-3. 6.4.1 and later Appliances complies to FIPS 140-3 when it comes to Appliance to Appliance and Client to Appliance communication. See [https://csrc.nist.gov/publications/detail/fips/140/3/final.](https://csrc.nist.gov/publications/detail/fips/140/3/final) AppGate ZTNA uses the wolfCrypt module. See [https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/4718.](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/4718) 6.4.0 Desktop Clients and Appliances complies to FIPS 140-2. |