From 5c4e44772853a540f67b772fff02e423a82634d9 Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Tue, 28 Apr 2026 10:49:49 +0200
Subject: [PATCH] Fix: TLS: Disable cipher suited option disables wrong ciphers

---
 CHANGELOG.md                                |  1 +
 crates/common/src/config/server/listener.rs | 10 +++-------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5107e30f..448b496b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - Allow HTTP to be used for configuring the server.
 
 ## Fixed
+- TLS: Disable cipher suited option disables wrong ciphers.
 
 ## [0.16.1] - 2026-04-25
 
diff --git a/crates/common/src/config/server/listener.rs b/crates/common/src/config/server/listener.rs
index cc089f88..2970d85a 100644
--- a/crates/common/src/config/server/listener.rs
+++ b/crates/common/src/config/server/listener.rs
@@ -213,14 +213,10 @@ impl Listeners {
                 let mut disabled_ciphers: Vec<SupportedCipherSuite> = Vec::new();
                 for disabled in listener.tls_disable_cipher_suites {
                     disabled_ciphers.push(match disabled {
-                        TlsCipherSuite::Tls13Aes256GcmSha384 => {
-                            TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-                        }
-                        TlsCipherSuite::Tls13Aes128GcmSha256 => {
-                            TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
-                        }
+                        TlsCipherSuite::Tls13Aes256GcmSha384 => TLS13_AES_256_GCM_SHA384,
+                        TlsCipherSuite::Tls13Aes128GcmSha256 => TLS13_AES_128_GCM_SHA256,
                         TlsCipherSuite::Tls13Chacha20Poly1305Sha256 => {
-                            TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
+                            TLS13_CHACHA20_POLY1305_SHA256
                         }
                         TlsCipherSuite::TlsEcdheEcdsaWithAes256GcmSha384 => {
                             TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384