Transport layer encryption

Virtual Cards uses HTTPS (TLS) for transport layer security.

Transport layer encryption with HTTPS

All API endpoints must be served using HTTPS with TLS 1.2 or higher. API clients must have common name (CN) checking turned on and the server's CN or wildcards must match the hostname.

Your server's certificate must be issued by a root certificate included in the Mozilla CA certification program.

Cipher suites

The server must support at least one of these cipher suites and should not support cipher suites outside of the following set:

  • ECDHE-ECDSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-ECDSA-CHACHA20-POLY1305
  • ECDHE-RSA-CHACHA20-POLY1305
  • ECDHE-ECDSA-AES128-SHA256
  • ECDHE-RSA-AES128-SHA256