# What Is TLS 1.3 (Transport Layer Security 1.3)?

> TLS 1.3 is the current version of Transport Layer Security (RFC 8446 in 2018, now RFC 9846), with a one-round-trip handshake and only AEAD ciphers.

Source: https://ssl.sh/glossary/tls-1-3/
Last updated: 2026-11-10

TLS 1.3 is the latest version of TLS. It was first published as [RFC 8446](https://www.rfc-editor.org/rfc/rfc8446) in August 2018; [RFC 9846](https://www.rfc-editor.org/rfc/rfc9846) (July 2026) is now its specification and obsoletes RFC 8446 and RFC 5246. It is a redesign rather than an increment: static RSA and static Diffie-Hellman key exchange are gone, so every full handshake uses ephemeral (EC)DHE; CBC, RC4, 3DES, compression and renegotiation were removed; and everything after the ServerHello, including the server certificate, is encrypted. Only five cipher suites exist, all [AEAD](https://ssl.sh/glossary/aead/).

## Why it matters
A full TLS 1.3 handshake needs one round trip instead of two, and resumed connections can send [0-RTT](https://ssl.sh/glossary/0-rtt/) early data. Because the weak options no longer exist, there is far less room for misconfiguration, and [forward secrecy](https://ssl.sh/glossary/forward-secrecy/) is the default for full handshakes. New features build on it: post-quantum hybrid key exchange such as X25519MLKEM768 (used by Chrome since version 131) and Encrypted Client Hello are TLS 1.3 only.

## Example
Test TLS 1.3 support and pin the TLS 1.3 suites in nginx (OpenSSL 1.1.1 or later):

```bash
openssl s_client -connect example.com:443 -tls1_3
```

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
```

## Common misconceptions
- **"TLS 1.3 needs a special certificate."** Existing RSA and ECDSA certificates work unchanged; support depends on the server's TLS library and configuration.
- **"0-RTT is free speed."** Early data can be replayed by an attacker, so it should only carry idempotent requests.
- **"TLS 1.3 hides which site I visit."** The SNI hostname is still sent in clear text in the ClientHello unless [ECH](https://ssl.sh/glossary/ech/) is used.

## Related terms

- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [TLS 握手](https://ssl.sh/zh/glossary/tls-handshake/): TLS 握手是 TLS 连接开始时的一组消息交换，客户端与服务器在其中协商协议版本和密码套件、验证服务器身份并派生会话密钥。
- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。
- [0-RTT](https://ssl.sh/zh/glossary/0-rtt/): 0-RTT 是 TLS 1.3 和 QUIC 的特性，允许回访的客户端用上一次会话留下的密钥，在第一个数据包里就发送应用数据。
- [PSK](https://ssl.sh/zh/glossary/psk/): PSK（预共享密钥）是 TLS 双方在握手前就已共同持有的秘密，用于会话恢复，或在不使用证书的情况下完成身份认证。
- [ECH](https://ssl.sh/zh/glossary/ech/): ECH 是 TLS 1.3 的扩展，用发布在 DNS 中的公钥加密 ClientHello 的敏感部分（包括 SNI），链路上只能看到前端服务器的公共名称。
- [X25519MLKEM768](https://ssl.sh/zh/glossary/x25519mlkem768/): X25519MLKEM768 是把经典的 X25519 与后量子算法 ML-KEM-768 组合起来的 TLS 1.3 混合密钥交换群，Chrome 从 131 版起使用。