bk99.de entertain the web since 1997

bk99.de
RFC · TLSStandard explained

RFC 9849: TLS Encrypted ClientHello

Summary

RFC 9849 encrypts most of the TLS ClientHello and thereby protects destination and negotiation data that used to be visible. Content encryption alone does not hide all metadata of a connection. More privacy changes troubleshooting and network filtering.

Ideas

  • A public ECH configuration object starts the encryption.
  • The inner ClientHello contains the actual server name.
  • The outer ClientHello stays compatible for paths without support.

Remarks

  • RFC 9849 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Update DNS, CDN and TLS configuration in a coordinated way.
  • Test fallback and key rotation from different networks.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2008

RFC 5246: TLS 1.2: Encrypted transport connections

RFC 5246 standardises TLS 1.2 and shaped encrypted communication on the web for many years. RFC 5246 was superseded by RFC 8446. Protocol security also depends on algorithm selection and implementation.

RFC · 2026

RFC 9846: TLS 1.3: The consolidated current specification

RFC 9846 replaces RFC 8446 and consolidates TLS 1.3 with the corrections and updates published up to then. Security standards occasionally need a consolidated new edition instead of many scattered updates. Superseding the document changes the reference, not the goal of a smaller, secure protocol.

RFC · 2018

RFC 8446: TLS 1.3: Less legacy, a faster handshake

RFC 8446 defines TLS 1.3 with modern algorithms, forward secrecy and a simplified handshake. RFC 8446 was superseded by RFC 9846. Removing insecure choices improves both security and ease of implementation.