TLS 1.3 (Transport Layer Security 1.3)

TLS 1.3 is the latest version of TLS. It was first published as RFC 8446 in August 2018; RFC 9846 (July 2026) is now its specification and obsoletes RFC 8446 and RFC 5246. It is a redesign rather than an increment: static RSA and static Diffie-Hellman key exchange are gone, so every full handshake uses ephemeral (EC)DHE; CBC, RC4, 3DES, compression and renegotiation were removed; and everything after the ServerHello, including the server certificate, is encrypted. Only five cipher suites exist, all AEAD.

Why it matters

A full TLS 1.3 handshake needs one round trip instead of two, and resumed connections can send 0-RTT early data. Because the weak options no longer exist, there is far less room for misconfiguration, and forward secrecy is the default for full handshakes. New features build on it: post-quantum hybrid key exchange such as X25519MLKEM768 (used by Chrome since version 131) and Encrypted Client Hello are TLS 1.3 only.

Example

Test TLS 1.3 support and pin the TLS 1.3 suites in nginx (OpenSSL 1.1.1 or later):

openssl s_client -connect example.com:443 -tls1_3

ssl_protocols TLSv1.2 TLSv1.3;
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;

Common misconceptions

• "TLS 1.3 needs a special certificate." Existing RSA and ECDSA certificates work unchanged; support depends on the server's TLS library and configuration.
• "0-RTT is free speed." Early data can be replayed by an attacker, so it should only carry idempotent requests.
• "TLS 1.3 hides which site I visit." The SNI hostname is still sent in clear text in the ClientHello unless ECH is used.