RFC 9918

Updates to Using the NETCONF Protocol over Transport Layer Security (TLS) with Mutual X.509 Authentication

📅 published July 2026, from ietf

Updates to Using the NETCONF Protocol over Transport Layer Security (TLS) with Mutual X.509 Authentication 🎀

Okay bestie, this is RFC 9918 from the IETF (Internet Engineering Task Force) 🌸 It's a Standards Track doc, so it's the real deal, not a someday idea. It's dated July 2026, the ISSN is 2070-1721, and the authors are Sean Turner (sn3rd) and Russ Housley (Vigil Security) 👑 It updates RFC 7589 and doesn't list anything it obsoletes. Stay with me, the whole thing is about making NETCONF safer with TLS, and it's giving upgrade era 💅

Abstract ✨

Okay so RFC 7589 is the doc that explains how to protect Network Configuration Protocol (NETCONF) messages with TLS 1.2 🔐 This one updates RFC 7589 so the TLS 1.2 support requirements get refreshed, and adds TLS 1.3 support requirements too 🦋 It also puts restrictions on TLS 1.3's early data, which is so important, trust me 🙈

Status of This Memo 📜

This is an Internet Standards Track document 🌈

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check out Section 2 of RFC 7841 💜

For the current status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc9918 ✨

Copyright Notice 🦋

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully because they spell out your rights and restrictions for this doc 📜 Code Components pulled out of this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Revised BSD License 🫶

Table of Contents 🗂️

1. Introduction
2. Conventions
3. Early Data
4. Cipher Suites
5. Security Considerations
6. IANA Considerations
7. Normative References
Acknowledgments
Authors' Addresses

1. Introduction 🌸

Okay so [RFC7589] is the one that explains how to protect NETCONF messages [RFC6241] with TLS 1.2 [RFC5246] 💅 This document updates [RFC7589] to refresh the support requirements for TLS 1.2 [RFC5246] and add TLS 1.3 [RFC9846] support requirements, including restrictions on the use of TLS 1.3's early data, which is also called 0-RTT data ⏱️ It also updates the "netconf-tls" entry, the IANA-registered port number, so it points to this document 🎀 Everything else in [RFC7589] stays exactly the same, including connection initiation, message framing, connection closure, certificate validation, server identity, and client identity ✨

NOTE: Implementations that support TLS 1.3 [RFC9846] SHOULD also follow Sections 4 and 5 of [RFC7589] 🫶

2. Conventions 🧚

Okay, so the key words are the big ones that tell you how strict a rule is 💜 They are "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL". Per BCP 14 [RFC2119] [RFC8174], they only mean the official thing when they show up in all capitals, exactly like that, and not any other way 🌈

3. Early Data 🦋

Early data (aka 0-RTT data) is a TLS 1.3 [RFC9846] feature that lets a client send data ("early data") in the very first flight of messages to a server 🚀 TLS 1.3 can totally work without early data too, see Appendix F.5 of [RFC9846] 🌸 Real talk, early data is only allowed by TLS 1.3 when the client and server share a Pre-Shared Key (PSK). That PSK can come from outside the protocol or from an earlier handshake 🔑 The client uses the PSK to authenticate the server and to encrypt the early data 🔐

Now here's the drama. As Section 2.3 of [RFC9846] says, the security properties for early data are weaker than for regular TLS-protected data 💀 Early data isn't forward secret, and nothing protects against replaying early data between connections 😭 Appendix F.5 of [RFC9846] says applications should not use early data unless a profile defines how it gets used 🙈 So this document says that NETCONF implementations supporting TLS 1.3 or later MUST NOT use early data. No exceptions, bestie 🚫

4. Cipher Suites 🔥

Implementations MUST support mutually authenticated TLS 1.2 [RFC5246], and as specified in [RFC9325], they are recommended to support the cipher suites found in Section 4.2 of [RFC9325] 🔐

Implementations MAY implement additional TLS 1.2 cipher suites that provide mutual authentication [RFC5246] and confidentiality, as required by NETCONF [RFC6241] 🦋

Implementations SHOULD support mutually authenticated TLS 1.3 [RFC9846]. And if they implement it, they MUST prefer to negotiate TLS 1.3 over earlier versions of TLS 👑

Implementations that support TLS 1.3 [RFC9846] are REQUIRED to support the mandatory-to-implement cipher suites listed in Section 9.1 of [RFC9846] 💖

Implementations that support TLS 1.3 MAY implement additional TLS cipher suites that provide mutual authentication and confidentiality, which NETCONF [RFC6241] requires 🌸

5. Security Considerations 🛡️💀

Lowkey the most important section, so read closely 🫶 The security considerations of [RFC6241], [RFC7589], and [RFC9325] apply here too ✨

NETCONF implementations SHOULD follow the TLS recommendations given in [RFC9325] 🔐

For implementations that support TLS 1.3, the security considerations of TLS 1.3 [RFC9846] apply 🦋

As specified in [RFC7589], NETCONF over TLS requires mutual authentication 🤝

For implementations that support TLS 1.3 [RFC9846]:

TLS 1.3 mutual authentication is used to make sure that only authorized users and systems can view the NETCONF server's configuration and state, or change the NETCONF server's configuration. So neither the client nor the server should set up a NETCONF over TLS 1.3 connection with an unknown, unexpected, or incorrectly identified peer. See Section 7 of [RFC7589] 🚨 If deployments use a trusted list of Certification Authority (CA) certificates [RFC5280], then the listed CAs should only issue certificates to parties that are authorized to access the NETCONF servers. Doing otherwise lets certificates that were issued for other purposes get accepted by a NETCONF server, and that's a whole disaster 💀

The security considerations of [RFC9525] apply to all implementations when the client checks the identity of the server, as is required in Section 6 of [RFC7589] 👑

6. IANA Considerations 📋

IANA added a reference to this document in the "netconf-tls" entry in the "Service Name and Transport Protocol Port Number Registry" 🎀 Here's the updated entry:

Service Name:  netconf-tls
Port Number:  6513
Transport Protocol:  tcp
Description:  NETCONF over TLS
Assignee:  IESG <iesg@ietf.org>
Contact:  IETF Chair <chair@ietf.org>
Reference:  RFC 7589, RFC 9918

7. Normative References 📚

These are the references the spec leans on, and you need them for the full picture 🧚

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
           (TLS) Protocol Version 1.2", RFC 5246,
           DOI 10.17487/RFC5246, August 2008,
           <https://www.rfc-editor.org/info/rfc5246>.

[RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
           Housley, R., and W. Polk, "Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
           <https://www.rfc-editor.org/info/rfc5280>.

[RFC6241]  Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
           and A. Bierman, Ed., "Network Configuration Protocol
           (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
           <https://www.rfc-editor.org/info/rfc6241>.

[RFC7589]  Badra, M., Luchuk, A., and J. Schoenwaelder, "Using the
           NETCONF Protocol over Transport Layer Security (TLS) with
           Mutual X.509 Authentication", RFC 7589,
           DOI 10.17487/RFC7589, June 2015,
           <https://www.rfc-editor.org/info/rfc7589>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC9325]  Sheffer, Y., Saint-Andre, P., and T. Fossati,
           "Recommendations for Secure Use of Transport Layer
           Security (TLS) and Datagram Transport Layer Security
           (DTLS)", BCP 195, RFC 9325, DOI 10.17487/RFC9325, November
           2022, <https://www.rfc-editor.org/info/rfc9325>.

[RFC9525]  Saint-Andre, P. and R. Salz, "Service Identity in TLS",
           RFC 9525, DOI 10.17487/RFC9525, November 2023,
           <https://www.rfc-editor.org/info/rfc9525>.

[RFC9846]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
           Version 1.3", RFC 9846, DOI 10.17487/RFC9846, July 2026,
           <https://www.rfc-editor.org/info/rfc9846>.

Acknowledgments 🫶

Big thank-yous to Per Andersson, Jürgen Schönwälder, Jeff Hartley, Rob Wilton, and Qin Wu for reviewing this 🌷

Authors' Addresses 💌

Sean Turner
sn3rd
Email: sean@sn3rd.com


Russ Housley
Vigil Security, LLC
516 Dranesville Road
Herndon, VA 20170
United States of America
Email: housley@vigilsec.com

📦 where this page comes from

ietf: rfc9918 2026-07
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms