Skip to content

fix(security): RFC 8446 is obsolete — cite RFC 9846 for TLS 1.3 #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jdevalk merged 1 commit into from
Jul 17, 2026
+9 −4
Merged

fix(security): RFC 8446 is obsolete — cite RFC 9846 for TLS 1.3 #111

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions src/content/spec/security/https-tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,13 @@ status: required
order: 10
appliesTo: [all]
relatedSlugs: [hsts, caa-records, content-security-policy, mixed-content]
updated: "2026-07-09T00:00:00.000Z"
updated: "2026-07-17T00:00:00.000Z"
sources:
- title: "RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3"
url: "https://www.rfc-editor.org/rfc/rfc8446"
- title: "RFC 9846 — The Transport Layer Security (TLS) Protocol Version 1.3"
url: "https://www.rfc-editor.org/rfc/rfc9846"
publisher: "IETF"
- title: "RFC 9851 — TLS 1.2 is in Feature Freeze"
url: "https://www.rfc-editor.org/rfc/rfc9851"
publisher: "IETF"
- title: "Mozilla SSL Configuration Generator"
url: "https://ssl-config.mozilla.org/"
Expand All @@ -25,7 +28,9 @@ sources:

## What it is

HTTPS is HTTP carried over TLS, a protocol that encrypts and authenticates the connection between the browser and the server. TLS 1.3 (RFC 8446) is the current version; TLS 1.2 remains acceptable. Everything earlier — TLS 1.0, TLS 1.1, and all versions of SSL — is broken and must be disabled.
HTTPS is HTTP carried over TLS, a protocol that encrypts and authenticates the connection between the browser and the server. TLS 1.3 is the current version, specified by RFC 9846 — a July 2026 revision that obsoleted RFC 8446 without changing the version number or breaking compatibility. TLS 1.2 remains acceptable. Everything earlier — TLS 1.0, TLS 1.1, and all versions of SSL — is broken and must be disabled.

"Acceptable" is not the same as "equal", though, and the gap is widening rather than holding steady. TLS 1.2 is in feature freeze (RFC 9851): it receives urgent security fixes and nothing else, and post-quantum key exchange is being specified for TLS 1.3 and later only. Keeping TLS 1.2 enabled for the clients that still need it is sound; treating it as a version you can sit on indefinitely is not.

What HTTPS does not do is vouch for the site. The certificate proves you are talking to the genuine holder of the name in the address bar, and that nobody on the path can read or alter the bytes. It says nothing about whether that party is honest: a phishing page served over flawless HTTPS shows the same padlock a bank does. HTTPS secures the channel, not the character of whatever is at the far end of it.

Expand Down
Loading