TLS Cipher Suite Hardening for Anypoint MQ Endpoints (April–May 2026)

As part of ongoing Salesforce security hardening efforts, Anypoint MQ endpoints were updated to comply with current Salesforce security standards and modern TLS best practices.

This hardening includes:
Supporting only AEAD cipher suites such as:
GCM

As a result, legacy cipher suites are no longer accepted, including:

CBC-SHA ciphers
Static-RSA cipher suites

These legacy ciphers had already been deprecated in underlying TLS libraries and are now fully disabled on Anypoint MQ endpoints.

Impact:

External applications using older TLS configurations or legacy cipher suites may fail to establish SSL/TLS connections to Anypoint MQ endpoints.

Typical symptoms include:
- SSL handshake failures
- Inability to publish or consume MQ messages