bk99.de entertain the web since 1997

bk99.de
RFC · TLSStandard explained

RFC 5246: TLS 1.2: Encrypted transport connections

Summary

RFC 5246 standardises TLS 1.2 and shaped encrypted communication on the web for many years. RFC 5246 was superseded by RFC 8446. Protocol security also depends on algorithm selection and implementation.

Ideas

  • The handshake negotiates version, algorithms and keys.
  • Certificates bind public keys to identities.
  • Record protection encrypts and authenticates application data.

Insights

  • Long-lived standards need active retirement of weak options.

Remarks

  • RFC 5246 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Prefer TLS 1.3 and disable outdated methods.
  • Automate certificate renewal and monitor expiry dates.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2026

RFC 9849: TLS Encrypted ClientHello

RFC 9849 encrypts most of the TLS ClientHello and thereby protects destination and negotiation data that used to be visible. Content encryption alone does not hide all metadata of a connection. More privacy changes troubleshooting and network filtering.

RFC · 2026

RFC 9846: TLS 1.3: The consolidated current specification

RFC 9846 replaces RFC 8446 and consolidates TLS 1.3 with the corrections and updates published up to then. Security standards occasionally need a consolidated new edition instead of many scattered updates. Superseding the document changes the reference, not the goal of a smaller, secure protocol.

RFC · 2018

RFC 8446: TLS 1.3: Less legacy, a faster handshake

RFC 8446 defines TLS 1.3 with modern algorithms, forward secrecy and a simplified handshake. RFC 8446 was superseded by RFC 9846. Removing insecure choices improves both security and ease of implementation.