# TLS ciphers

**URL:** <https://community.purpleair.com/t/tls-ciphers/3521>\
**Category:** Troubleshooting\
**Created:** [February 5, 2023, 11:18pm UTC](https://community.purpleair.com/t/tls-ciphers/3521 "2023-02-05T23:18:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddd](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@ddd](https://community.purpleair.com/u/ddd)\
**Post date:** [February 5, 2023, 11:18pm UTC](https://community.purpleair.com/t/tls-ciphers/3521/1 "2023-02-05T23:18:56Z")

</div>

Hello,

My firewall is warning me that my Purple Air is using “unsafe TLS ciphers”. Which version of TLS is being used? I have a PA-II-SD and a PA-I, both with the 7.02 firmware.

thanks,  
D

---

<div class="post-metadata">

**Author:** ![dwhitemv](https://sea2.discourse-cdn.com/flex020/user_avatar/community.purpleair.com/dwhitemv/32/1508_2.png) [@dwhitemv](https://community.purpleair.com/u/dwhitemv)\
**Post date:** [February 7, 2023, 3:02am UTC](https://community.purpleair.com/t/tls-ciphers/3521/2 "2023-02-07T03:02:52Z")

</div>

Is this an off-the-shelf firewall or something you built yourself?

Does the message say what site(s) are being accessed with the unsafe ciphers, and are they inbound or outbound of your network?

“Unsafe TLS cipher” as an alert shows up in the `ntop` software package, which isn’t something you generally see in consumer firewalls.

That means, of course, your firewall is actively sniffing all your traffic.

---

<div class="post-metadata">

**Author:** ![ddd](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@ddd](https://community.purpleair.com/u/ddd)\
**Post date:** [February 7, 2023, 7:58am UTC](https://community.purpleair.com/t/tls-ciphers/3521/3 "2023-02-07T07:58:57Z")

</div>

I use a pfsense firewall with ntopng sniffing everything.

And, the “unsafe TLS cipher” traffic is outbound from my purpleair sensors to [www.purpleair.com](http://www.purpleair.com) and [sensors-ingest.wunderground.com](http://sensors-ingest.wunderground.com)

---

<div class="post-metadata">

**Author:** ![dwhitemv](https://sea2.discourse-cdn.com/flex020/user_avatar/community.purpleair.com/dwhitemv/32/1508_2.png) [@dwhitemv](https://community.purpleair.com/u/dwhitemv)\
**Post date:** [February 14, 2023, 9:53pm UTC](https://community.purpleair.com/t/tls-ciphers/3521/4 "2023-02-14T21:53:20Z")

</div>

Ah, well then, welcome to 2000s era intrusion detection technology. Expect lots of false positives and alerts about non-issues.

I ran the SSL Labs analyzer on those two sites and it determines that old TLS versions and weak ciphers are accepted on those sites. The core issue is likely whether older versions/ciphers must be accepted to support older sensor hardware.

The user-facing site for PurpleAir is actually [www2.purpleair.com](http://www2.purpleair.com) which has a good TLS score. [www.purpleair.com](http://www.purpleair.com) is a Google frontend that nominally redirects to www2, but (probably) handles ingest from the sensors directly. I wouldn’t think there is much PA hardware out there that is pre-TLSv1.3, so they could tighten that up.

wunderground is more egregious since they haven’t updated their servers to accept TLSv1.3 yet, but that’s no surprise given WU has been on autopilot for several years now. That said, there’s decades of hardware out there sending stuff to WU and I doubt they are interested in breaking them.

---

<div class="post-metadata">

**Author:** ![ddd](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@ddd](https://community.purpleair.com/u/ddd)\
**Post date:** [February 15, 2023, 1:36am UTC](https://community.purpleair.com/t/tls-ciphers/3521/5 "2023-02-15T01:36:55Z")

</div>

Ah, ok, thanks! I won’t worry about it then.