Visual RFC.
ALL RFCs / RFC 8996
Read the RFC ↗
RFC 8996 / TRANSPORT SECURITY

DTLS is included too

04

The deprecation also applies to Datagram TLS 1.0, while leaving DTLS 1.2 outside this prohibition.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 6 ↗
RFC 8996 · § 6EXAMPLE
3 / 3
DTLS is included tooThe deprecation also applies to Datagram TLS 1.0, while leaving DTLS 1.2 outside this prohibition. Current state: Apply a supported modern policy..DTLS is included tooClientServerDTLS 1.0 offerobsolete versionprotocol_versionnew session · modern DTLS
03
Apply a supported modern policy.

The DTLS 1.2 protocol itself is not deprecated here.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
WHAT CHANGED
RFC 7525 § 3.1.2RFC 8996 § 6

The DTLS 1.0 negotiation rule is strengthened from SHOULD NOT to MUST NOT.

Read the updated RFC section ↗
KEY POINT

Do not negotiate DTLS 1.0.

  • RFC 8996 strengthens the DTLS 1.0 rule to MUST NOT negotiate.
  • DTLS 1.0 corresponds to TLS 1.1; there is no DTLS 1.1 version.
  • The document does not deprecate DTLS 1.2.
DETAILS

The numbering of TLS and DTLS versions is not a one-to-one sequence.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy
All chapters in this RFC
  1. Why retire a working protocol?
  2. Reject TLS 1.0 negotiation
  3. Reject TLS 1.1 negotiation
  4. DTLS is included too
  5. What changes for OAuth?
  6. Migration, fallback, and operations

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗