Abstract:
Transport Layer Security (TLS) is a protocol that secures Internet connections by encrypting communication between clients and servers. However, the security and behaviorof TLS also depend on how servers configure and deploy it. These deployments are shaped not only by protocol standards but also by regional rules and network policies. Whether such diverging regional deployments systematically weaken overall TLS security remains unresolved, and determining whether that is indeed the case is the central goal of this work. This thesis investigates whether China’s censorship policies and cryptographic regulations influence observable TLS server configurations. We hypothesize that operators intentionally self-censor their configurations to remain accessible to Chinese clients, for example, by avoiding TLS 1.3 or selecting specific cipher suites and elliptic curves. To verify this, we compare servers hosted in China with those outside China, using two datasets: a large IPv4 dataset and a domain list from Tranco. Our analysis examines protocol versions, cipher suites, elliptic curves, and signature algorithms, paying particular attention to forward secrecy and ShangMi (SM) cipher suites, which are becoming mandatory in China per RFC 8998. We extend the existing research tool, TLS-Scanner, with two custom probes to detect servers that implement TLS 1.3 but do not expose it for negotiation, and servers restricted to SM-based TLS 1.3 cipher suites. The results reveal distinct regional variations. Servers in China are less likely to support TLS 1.3 and more likely to retain deprecated protocols and non-forward-secret cipher suites enabled. They also more frequently show evidence that TLS 1.3 is implemented but disabled, which may be related to the Great Firewall’s reliance on plaintext SNI for filtering. SM support primarily serves as an additional option rather than replacing standard international TLS mechanisms. SM cipher suites are more frequently found on servers hosted in China, but there have been no observed deployments of SM-exclusive TLS 1.3. In addition, support for the SM2_SM3 signature algorithm is almost absent in the TLS 1.3 results, suggesting that RFC 8998 support is only partial. These findings suggest that China-hosted TLS deployments are not simply behind in TLS adoption. Instead, they show a different configuration pattern, combining modern TLS support with legacy options and selected China-specific cryptographic mechanisms.