TLS 1.3 Explained

TLS 1.3 is a major update to the Transport Layer Security protocol, finalized in 2018 (RFC 8446). It provides significant security and performance improvements over TLS 1.2.

Key Improvements

Feature	TLS 1.2	TLS 1.3
Handshake RTT	2 RTT	1 RTT (0-RTT resumption)
Forward Secrecy	Optional	Required (ECDHE only)
Weak ciphers	RC4, DES, 3DES	Removed
Key exchange	RSA allowed	DHE/ECDHE only

Cipher Suites

# TLS 1.3 Cipher Suites (only 5 allowed)
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
TLS_AES_128_CCM_8_SHA256
TLS_AES_128_CCM_SHA256

Nginx Configuration

server {
    listen 443 ssl http2;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_tickets off;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;
}

December 2024