TLS 1.2 (Transport Layer Security 1.2)

TLS 1.2 is the third version of TLS, defined in RFC 5246 in 2008. It replaced the fixed MD5/SHA-1 pseudo-random function with one whose hash is chosen by the cipher suite (normally SHA-256), added the signature_algorithms extension so peers can negotiate signature and hash algorithms, and made room for AEAD cipher suites such as AES-GCM. A full handshake takes two round trips before application data can flow.

Why it matters

Together with TLS 1.3, TLS 1.2 is one of only two versions that current browsers accept, and it is still needed for clients that cannot do TLS 1.3, such as older Android and Java versions and many embedded devices. Unlike TLS 1.3, its security depends heavily on configuration: the same protocol can negotiate a strong suite with ECDHE and AES-GCM, or a weak one with RSA key transport and CBC that offers no forward secrecy.

Example

A TLS 1.2 cipher list limited to forward-secret AEAD suites, using real OpenSSL names:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

In OpenSSL-based servers, ssl_ciphers applies to TLS 1.2 and below only; TLS 1.3 suites are configured separately.

Common misconceptions

• "TLS 1.2 is obsolete and should be disabled." It is not deprecated. With ECDHE key exchange and AEAD suites it is considered secure, and dropping it locks out clients that lack TLS 1.3.
• "Enabling TLS 1.2 is enough." The cipher list still matters: RSA key-exchange, CBC-SHA1 and 3DES suites remain negotiable under TLS 1.2 unless you remove them.
• "TLS 1.2 is slow." The extra round trip is real for full handshakes, but session resumption and connection reuse hide most of it.