Why retire a working protocol?
01Old cryptographic dependencies and compatibility code increase risk even when a connection still succeeds.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 1 ↗
RFC 8996 · § 1EXAMPLE
3 / 3
03
Use the remaining secure transport options.
A successful connection is useful only within an acceptable security policy.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Reduce the number of insecure options.
- TLS 1.0 and 1.1 lack support for current recommended cryptographic mechanisms.
- Old handshake integrity and authentication depend on SHA-1; TLS 1.0 also lacks per-record CBC initialization vectors.
- Removing old versions reduces downgrade opportunities and configuration burden.
This RFC is a deprecation policy, not the TLS 1.2 or TLS 1.3 wire-protocol specification.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy