This document formally deprecates Transport Layer Security (TLS)versions 1.0 (RFC 2246) and 1.1 (RFC 4346). Accordingly, thosedocuments have been moved to Historic status. These versions lacksupport for current and recommended cryptographic algorithms andmechanisms, and various government and industry profiles ofapplications using TLS now mandate avoiding these old TLS versions.TLS version 1.2 became the recommended version for IETF protocols in2008 (subsequently being obsoleted by TLS version 1.3 in 2018),providing sufficient time to transition away from older versions.Removing support for older versions from implementations reduces theattack surface, reduces opportunity for misconfiguration, andstreamlines library and product maintenance.
This document also deprecates Datagram TLS (DTLS) version 1.0 (RFC4347) but not DTLS version 1.2, and there is no DTLS version 1.1.
This document updates many RFCs that normatively refer to TLS version1.0 or TLS version 1.1, as described herein. This document alsoupdates the best practices for TLS usage in RFC 7525; hence, it ispart of BCP 195.
Transport Layer Security (TLS) and Datagram Transport Layer Security(DTLS) are used to protect data exchanged over a wide range ofapplication protocols and can also form the basis for securetransport protocols. Over the years, the industry has witnessedseveral serious attacks on TLS and DTLS, including attacks on themost commonly used cipher suites and their modes of operation. Thisdocument provides the latest recommendations for ensuring thesecurity of deployed services that use TLS and DTLS. Theserecommendations are applicable to the majority of use cases.
RFC 7525, an earlier version of the TLS recommendations, waspublished when the industry was transitioning to TLS 1.2. Yearslater, this transition is largely complete, and TLS 1.3 is widelyavailable. This document updates the guidance given the newenvironment and obsoletes RFC 7525. In addition, this documentupdates RFCs 5288 and 6066 in view of recent attacks.
For the definition ofStatus,seeRFC 2026.
For the definition ofStream, seeRFC 8729.