Transport Layer Security 1.3
Every HTTPS connection, SMTP/IMAP over TLS, OAuth token exchange, and API call uses TLS. It is the foundational security layer.
What It Defines
Defines TLS 1.3 — the current standard for encrypting and authenticating connections. Features: 1-RTT handshake, 0-RTT resumption, forward secrecy by default, eliminated weak algorithms.
Canonical (Normative)
Convenient (Practical)
The canonical publication point for finalized RFCs. If a protocol is standardized as an RFC, the RFC Editor text is the normative final reference. Published by the IETF, IRTF, IAB, and independent stream.
Related Specs
HTTP/3 runs on QUIC. Modern CDNs and browsers use it by default. It fixes TCP's head-of-line blocking problem for multiplexed requests.
A one-line HTTP header that eliminates a class of downgrade attacks. Every public web app should set HSTS.
Governs every TLS certificate you buy or provision via Let's Encrypt/ACM/Digicert. Understanding BR helps with cert errors, CAA records, and domain validation requirements.
This is the core contract of every web API, browser request, and server response. You can't design or debug HTTP without knowing this.