RFC 8740

Using TLS 1.3 with HTTP/2

📅 published February 2020, from ietf

RFC 8740: Using TLS 1.3 with HTTP/2 🎀

Title block, bestie! 💖

Series: Request for Comments: 8740 🌸
Publisher: Internet Engineering Task Force (IETF) 🧚
Author: David Benjamin, Google LLC
Date: February 2020 📅
Category: Standards Track 👑
Updates: RFC 7540 (HTTP/2) 🔥
Obsoletes: nothing is listed in this header
ISSN: 2070-1721

Abstract ✨

okay so this doc updates RFC 7540 to forbid TLS 1.3 post-handshake authentication 🙅‍♀️ It's basically the same vibe as the TLS 1.2 renegotiation restriction, just for TLS 1.3. Iconic, right? 💅

Status of This Memo 📜

This is an Internet Standards Track document. 👑

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 🫶

For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8740 🔗

Copyright Notice ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document have to include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License. Legal stuff, but important 💀

Table of Contents 🗺️

1.  Introduction
2.  Requirements Language
3.  Post-Handshake Authentication in HTTP/2
4.  Other Post-Handshake TLS Messages in HTTP/2
5.  Security Considerations
6.  IANA Considerations
7.  References
  7.1.  Normative References
  7.2.  Informative References
Author's Address

1. Introduction 🦋

TLS 1.2 [RFC5246] and earlier versions of TLS support renegotiation. That's a mechanism for changing parameters and keys partway through a connection. People sometimes used it for reactive client authentication in HTTP/1.1 [RFC7230], where the server decides whether to ask for a client certificate based on the HTTP request. Clever, but messy 🙈

HTTP/2 [RFC7540] multiplexes several HTTP requests over one connection, and that clashes with the trick above. Clients can't match the certificate request with the HTTP request that set it off. So Section 9.2.1 of [RFC7540] forbids renegotiation 🚫

TLS 1.3 [RFC8446] removes renegotiation and swaps it for separate post-handshake authentication and key update mechanisms. Post-handshake authentication has the same problems with multiplexed protocols as TLS 1.2 renegotiation does. The catch is that the prohibition in [RFC7540] only covers renegotiation, so this gap is exactly what this doc fixes 🔧

This document updates HTTP/2 [RFC7540] to similarly forbid TLS 1.3 post-handshake authentication. Slay ✨

2. Requirements Language 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. Capitals are the magic word here, so watch them 👀

3. Post-Handshake Authentication in HTTP/2 🔐

HTTP/2 servers MUST NOT send post-handshake TLS 1.3 CertificateRequest messages. HTTP/2 clients MUST treat such messages as connection errors (see Section 5.4.1 of [RFC7540]) of type PROTOCOL_ERROR. Those are the rules, no exceptions 🙅‍♀️

[RFC7540] allowed renegotiation before the HTTP/2 connection preface, so the client certificate stayed confidential. TLS 1.3 encrypts the client certificate in the initial handshake, so that workaround isn't needed anymore. Since it's not needed, HTTP/2 servers MUST NOT send post-handshake TLS 1.3 CertificateRequest messages before the connection preface either. Lowkey simple, highkey strict 💅

The rules above still apply even if the client offered the post_handshake_auth TLS extension. That extension gets advertised independently of the selected Application-Layer Protocol Negotiation (ALPN) protocol [RFC7301], so it doesn't fix the conflict with HTTP/2 on its own. HTTP/2 clients that also offer other ALPN protocols, like HTTP/1.1, in a TLS ClientHello MAY include the post_handshake_auth extension so they can support those other protocols. Including it does not mean HTTP/2 support 🧩

4. Other Post-Handshake TLS Messages in HTTP/2 🍓

[RFC8446] defines two other messages that get exchanged after the handshake is done: KeyUpdate and NewSessionTicket. 🤓

KeyUpdate messages only affect TLS itself and don't need any interaction with the application protocol. HTTP/2 implementations MUST support key updates when TLS 1.3 is negotiated. No skipping this one bestie 🔑

NewSessionTicket messages are also permitted. These do interact with HTTP when early data is enabled, but those interactions are defined in [RFC8470] and were allowed for in the design of HTTP/2. ✨

Unless a new type of TLS message depends on an interaction with the application-layer protocol, that TLS message can be sent after the handshake completes. Easy access, no drama 🦋

5. Security Considerations 🚨

This is serious, so listen up 🫢 This document resolves a compatibility concern between HTTP/2 and TLS 1.3 when you're supporting post-handshake authentication alongside HTTP/1.1. And that lowers the barrier for deploying TLS 1.3, which is a major security upgrade over TLS 1.2. Security glow-up unlocked 🔥💖

6. IANA Considerations 🗂️

This document has no IANA actions. Nothing to register, nothing to fill in 🌸

7. References 📚

7.1. Normative References 🎀

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
           (TLS) Protocol Version 1.2", RFC 5246,
           DOI 10.17487/RFC5246, August 2008,
           <https://www.rfc-editor.org/info/rfc5246>.

[RFC7230]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Message Syntax and Routing",
           RFC 7230, DOI 10.17487/RFC7230, June 2014,
           <https://www.rfc-editor.org/info/rfc7230>.

[RFC7301]  Friedl, S., Popov, A., Langley, A., and E. Stephan,
           "Transport Layer Security (TLS) Application-Layer Protocol
           Negotiation Extension", RFC 7301, DOI 10.17487/RFC7301,
           July 2014, <https://www.rfc-editor.org/info/rfc7301>.

[RFC7540]  Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext
           Transfer Protocol Version 2 (HTTP/2)", RFC 7540,
           DOI 10.17487/RFC7540, May 2015,
           <https://www.rfc-editor.org/info/rfc7540>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
           Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
           <https://www.rfc-editor.org/info/rfc8446>.

7.2. Informative References 💜

[RFC8470]  Thomson, M., Nottingham, M., and W. Tarreau, "Using Early
           Data in HTTP", RFC 8470, DOI 10.17487/RFC8470, September
           2018, <https://www.rfc-editor.org/info/rfc8470>.

Author's Address 🧚

David Benjamin
Google LLC

Email: davidben@google.com

📦 where this page comes from

ietf: rfc8740 2020-02
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms