NIST SP 800-52 Rev 2: TLS Configuration Guidelines for Federal and Enterprise Systems

NIST SP 800-52 Revision 2 is the authoritative guide for configuring TLS in federal information systems — and increasingly, the baseline that enterprise security teams reference for their own TLS policies. Published in August 2019, it defines which TLS versions, cipher suites, extensions, and certificate configurations are acceptable for systems processing government data.

If you’re pursuing FedRAMP authorization, handling CUI (Controlled Unclassified Information), or simply want a defensible TLS configuration standard, this is the document your auditors will reference. Here’s what it requires and how to implement it.

Scope and Applicability

SP 800-52 Rev 2 applies to:

• Federal agencies and their information systems
• Contractors processing federal data (CUI, FISMA systems)
• FedRAMP cloud service providers
• Any organization adopting NIST guidelines as their TLS baseline

It covers both TLS servers (web servers, API endpoints, mail servers) and TLS clients (browsers, API consumers, mail clients) — with different requirements for each.

Protocol Version Requirements

What’s Allowed

Key distinction: “SHALL” in NIST language means mandatory. There’s no wiggle room — if your server still accepts TLS 1.0 connections, you’re non-compliant.

Implementation

# Verify which protocols a server supports
openssl s_client -connect server.example.com:443 -tls1_3
openssl s_client -connect server.example.com:443 -tls1_2
openssl s_client -connect server.example.com:443 -tls1_1  # Should FAIL
openssl s_client -connect server.example.com:443 -tls1    # Should FAIL

Cipher Suite Requirements

SP 800-52 Rev 2 specifies approved cipher suites by referencing NIST SP 800-56A (key establishment) and SP 800-56C (key derivation). In practice, this means:

TLS 1.3 Cipher Suites (All Approved)

TLS 1.3 simplified the cipher suite landscape. All three standard suites are NIST-approved:

TLS 1.2 Approved Cipher Suites

For TLS 1.2, only specific combinations are approved:

Explicitly Prohibited

Practical Configuration

Nginx (NIST SP 800-52 compliant):

server {
    listen 443 ssl;
    server_name api.example.gov;

    # Protocol versions — TLS 1.2 and 1.3 only
    ssl_protocols TLSv1.2 TLSv1.3;

    # Cipher suites — NIST-approved only, prefer ECDHE + AESGCM
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256';
    ssl_prefer_server_ciphers on;

    # ECDHE curve — NIST P-256 or P-384
    ssl_ecdh_curve secp384r1:secp256r1;

    # DHE parameters — minimum 2048-bit
    ssl_dhparam /etc/nginx/dhparam-4096.pem;

    # Session configuration
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;  # Disable for forward secrecy

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;

    # Certificate
    ssl_certificate /etc/nginx/certs/server-chain.pem;
    ssl_certificate_key /etc/nginx/certs/server.key;
    ssl_trusted_certificate /etc/nginx/certs/ca-chain.pem;
}

Apache (NIST SP 800-52 compliant):

<VirtualHost *:443>
    ServerName api.example.gov

    SSLEngine on
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder on

    # Disable compression (CRIME attack)
    SSLCompression off

    # OCSP stapling
    SSLUseStapling on
    SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

    # Certificate files
    SSLCertificateFile /etc/httpd/certs/server.crt
    SSLCertificateKeyFile /etc/httpd/certs/server.key
    SSLCertificateChainFile /etc/httpd/certs/ca-chain.crt
</VirtualHost>

Generate 4096-bit DH parameters:

openssl dhparam -out /etc/nginx/dhparam-4096.pem 4096
# This takes several minutes — generate once, deploy everywhere

# Check if OpenSSL is running in FIPS mode
openssl version -a | grep FIPS

# Enable FIPS mode in OpenSSL 3.x
# Edit /etc/ssl/openssl.cnf:
# [openssl_init]
# providers = provider_sect
# [provider_sect]
# fips = fips_sect
# [fips_sect]
# activate = 1

# Comprehensive TLS audit against NIST requirements
testssl.sh --protocols --ciphers --server-defaults --vulnerabilities https://api.example.gov

# Key checks:
# - No TLS 1.0/1.1 support
# - No RC4, 3DES, NULL, EXPORT ciphers
# - Forward secrecy on all cipher suites
# - Certificate key size ≥ 2048 RSA / P-256 ECDSA
# - SHA-256+ signature algorithm
# - OCSP stapling enabled
# - No known vulnerabilities (BEAST, POODLE, Heartbleed, etc.)

# Check protocol support
for proto in tls1 tls1_1 tls1_2 tls1_3; do
  echo -n "$proto: "
  openssl s_client -connect api.example.gov:443 -$proto 2>/dev/null | grep "Protocol" || echo "NOT SUPPORTED"
done

# List accepted cipher suites
openssl s_client -connect api.example.gov:443 -tls1_2 2>/dev/null | grep "Cipher is"
openssl s_client -connect api.example.gov:443 -tls1_3 2>/dev/null | grep "Cipher is"

# Check certificate details
openssl s_client -connect api.example.gov:443 -servername api.example.gov 2>/dev/null | \
  openssl x509 -noout -text | grep -E "Public-Key|Signature Algorithm|Subject Alternative"