RFC 8996 / TRANSPORT SECURITY

Migration, fallback, and operations

A peer that only supports a retired version will stop interoperating when the new policy is applied.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

RFC 8996 · § 7EXAMPLE

4 / 4

Reconnect using an acceptable protocol.

Both peers now operate under the intended security policy.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

KEY POINT

Treat interoperability loss as an upgrade task.

Inventory and upgrade peers and libraries that require old TLS or DTLS versions.
The RFC recognizes that removal breaks interoperability with legacy-only peers; retaining them also incurs security risk.
§ 8 highlights the smaller attack surface when old protocols and fallback choices are removed.

DETAILS

The deprecation also obsoletes RFC 7507’s fallback SCSV mechanism; TLS 1.3 uses its own downgrade-sentinel mechanism (§ 1.1).

Diagrams simplify the RFC. Read the linked sections for complete requirements.

All chapters in this RFC