• Sources: RFC 9851, HN discussion
  • Summary: RFC 9851 places TLS 1.2 in feature freeze. The only additions still permitted are urgent security fixes decided by working group consensus, ALPN protocol identifiers, and exporter labels. The document states that post-quantum cryptography for TLS 1.2 will not be specified at any time, and that anyone deploying post-quantum cryptography should expect to use TLS 1.3. The document states twice that the freeze applies to TLS only and does not apply to DTLS in any DTLS version.
  • Why it matters: A TLS 1.2 endpoint now has a fixed capability ceiling, so a post-quantum migration plan that assumes TLS 1.2 will eventually carry the new key exchanges has no specification to wait for.

send feedback on this story