diff --git a/octavia/common/constants.py b/octavia/common/constants.py
index c4f383591e..310fada18d 100644
--- a/octavia/common/constants.py
+++ b/octavia/common/constants.py
@@ -896,13 +896,16 @@ CINDER_ACTION_CREATE_VOLUME = 'create volume'
 NIL_UUID = '00000000-0000-0000-0000-000000000000'
 
 # OpenSSL cipher strings
-CIPHERS_OWASP_SUITE_B = ('TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:'
-                         'TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:'
-                         'DHE-RSA-AES128-GCM-SHA256:'
+CIPHERS_OWASP_SUITE_B = ('TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:'
+                         'TLS_CHACHA20_POLY1305_SHA256:'
+                         'ECDHE-ECDSA-AES128-GCM-SHA256:'
+                         'ECDHE-RSA-AES128-GCM-SHA256:'
+                         'ECDHE-ECDSA-AES256-GCM-SHA384:'
                          'ECDHE-RSA-AES256-GCM-SHA384:'
-                         'ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:'
-                         'DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:'
-                         'ECDHE-RSA-AES128-SHA256')
+                         'ECDHE-ECDSA-CHACHA20-POLY1305:'
+                         'ECDHE-RSA-CHACHA20-POLY1305:'
+                         'DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:'
+                         'DHE-RSA-CHACHA20-POLY1305')
 
 TLS_VERSIONS_OWASP_SUITE_B = [lib_consts.TLS_VERSION_1_2,
                               lib_consts.TLS_VERSION_1_3]
diff --git a/releasenotes/notes/Updated-default-TLS-cipher-suites-7359fe87fc246618.yaml b/releasenotes/notes/Updated-default-TLS-cipher-suites-7359fe87fc246618.yaml
new file mode 100644
index 0000000000..ae751bccf3
--- /dev/null
+++ b/releasenotes/notes/Updated-default-TLS-cipher-suites-7359fe87fc246618.yaml
@@ -0,0 +1,24 @@
+---
+upgrade:
+  - |
+    The default TLS cipher suite list has been updated to the current
+    'intermediate' recommendations. Load balancers will need to be failed over
+    to use the new default list if the operator and user opted for the Octavia
+    default cipher list.
+security:
+  - |
+    Updated the default TLS cipher suites based on current OWASP/Mozilla.org
+    recommendations for Intermediate compatibility. The new default list is\:
+
+    - TLS_AES_128_GCM_SHA256
+    - TLS_AES_256_GCM_SHA384
+    - TLS_CHACHA20_POLY1305_SHA256
+    - ECDHE-ECDSA-AES128-GCM-SHA256
+    - ECDHE-RSA-AES128-GCM-SHA256
+    - ECDHE-ECDSA-AES256-GCM-SHA384
+    - ECDHE-RSA-AES256-GCM-SHA384
+    - ECDHE-ECDSA-CHACHA20-POLY1305
+    - ECDHE-RSA-CHACHA20-POLY1305
+    - DHE-RSA-AES128-GCM-SHA256
+    - DHE-RSA-AES256-GCM-SHA384
+    - DHE-RSA-CHACHA20-POLY1305