Keep version policy and cipher policy separate
05The RC4 prohibition applies to all TLS versions. RFC8996 later updates this publication by removing old TLS versions from use; a non-RC4 cipher does not rescue an obsolete version.
A non-RC4 TLS1.2 example passes these two gates only; continue the remaining TLS checks.
Source for this drawing: RFC 7465 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The later publication prohibits TLS1.0/1.1 and fallback to them; removing RC4 does not make those versions usable.
Read the updated RFC section ↗RFC8996§§4–5: implementations MUST NOT negotiate TLS1.0 or TLS1.1. Its§1.1 prohibits fallback to these versions and replaces older mandatory minimums with TLS1.2.
- RFC8996§§4–5: implementations MUST NOT negotiate TLS1.0 or TLS1.1. Its§1.1 prohibits fallback to these versions and replaces older mandatory minimums with TLS1.2.
- For the illustrated TLS1.2 case, both version policy and the no-RC4 policy must pass. Authentication, correct implementation and the rest of current TLS guidance still matter.
- These are independent policy examples, not an actual version downgrade exchange. No claim is made that RFC7465 is a complete modern TLS deployment checklist.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗