I want to remove RC4 from Google Chrome and found the commandline option --cipher-suite-blacklist. However I wasn't able to figure out what the correct notation for RC4 is. Whatever I tried so far only brought the message:

ERROR:ssl_config_service_manager_pref.cc(55)] Ignoring unrecognized or \
  unparsable cipher suite: 

Even the names listed in ssl_cipher_suite_names.cc don't work. What should I enter to remove RC4 as a cipher for SSL/TLS?

I'm working with some different versions of GNU/Linux and sometimes also with Windows. So it would be nice if the command-line argument would work under all OSes. I used the following command:

chrome --cipher-suite-blacklist=TLS_RSA_WITH_RC4_128_MD5 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=RC4 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=0xXYZ,0xUVW --ssl-version-min=tls1.1  # XYZ and UVW are some hexadecimal numbers
  • whats your OS? I assume you are trying commands from this page? code.google.com/p/chromium/issues/detail?id=58831 what was the exact command you entered? – Frank Thomas Jul 8 '13 at 15:29
  • Yes, I try the commands from this page as well as the linked IANA page. – qbi Jul 8 '13 at 19:17
  • what was your command exactly, and did you attempt to quote the argument containing the slash? – Frank Thomas Jul 8 '13 at 19:55
  • I'm playing around with Google Chrome and also with Chromium and have to double-check if they both use the same command-line args. – qbi Jul 8 '13 at 20:40

You must inform the ciphers in hex based in RFC 2246 (http://www.ietf.org/rfc/rfc2246.txt).

The correct command line is:

 chrome --cipher-suite-blacklist=0x0004,0x0005,0xc011

No spaces between comma.

  • 1
    This works, but I don't see from your link and answer how you decided to add the (necessary) option 0xc011. Could you please enlighten me? – king_julien Oct 21 '13 at 15:39
  • 2
    @gentmatt See iana.org/assignments/tls-parameters/… for a list of all cipher suites. You can ignore the anonymous, export, PSK and KRB5 cipher suites as they are not used. 0xC011 is TLS_ECDHE_RSA_WITH_RC4_128_SHA. Missing RC4 cipher suites in this list are 0xC002,0xC007,0xC00C. – Lekensteyn Nov 9 '13 at 8:45

Tiago is right.

However, there are some more ciphers You may want to block: https://www.opensource.apple.com/source/Security/Security-55163.44/libsecurity_ssl/Security/CipherSuite.h?txt

Consequently, you should try this command line:

chrome --cipher-suite-blacklist=0x0001,0x0002,0x0004,0x0005,0x0017,0x0018,0xc002,0xc007,0xc00c,0xc011,0xc016,0xff80,0xff81,0xff82,0xff83

It should block all ciphers using RC4 and/or MD5.



You need to add the following parameter to block all RC4 ciphers (as of Chrome 31 in Ubuntu 12.04 with NSS 3.15)


General Answer to figure it out yourself

The regularly updated list of all ciphers by IANA which user @Lekensteyn posted is already very helpful and definitely better than skimming some .txt files, but I have found an even easier way to...

  • check what ciphers your browser supports
  • get the hexadecimal value of the supported ciphers

Both information is provided directly in your browser by visiting the following website of the Leibniz University of Hannover:

In the picture below, the cipher indentifiers on are on the left side of the table. So, if I wanted to block the two ciphers RSA-AES-128-GCM-SHA256 and RSA-AES256-SHA I would look for (00,9c) and (00,35).

For Google Chrome this means that I have to add the parameter1:


enter image description here


1- In Google Chrome on Ubuntu you have to edit the file /usr/share/applications/google-chrome.desktop and add the parameter to each line that starts with Exec=/usr/bin/google-chrome-stable. There should be three overall.

Exec=/usr/bin/google-chrome-stable --cipher-suite-blacklist=0x009c,0x0035

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.