fix(security): RFC 8446 is obsolete — cite RFC 9846 for TLS 1.3#111
Merged
Conversation
RFC 9846 (July 2026) obsoletes RFC 8446. https-tls.md led with 8446 as its primary source and asserted "TLS 1.3 (RFC 8446) is the current version" in the body, so both the citation and the claim were stale. 9846 is a minor revision: same version number, backward compatible. Nothing about the page's advice changes and the status stays `required`. Also add the nuance that "TLS 1.2 remains acceptable" no longer means "TLS 1.2 is fine forever". RFC 9851 (July 2026) puts TLS 1.2 in feature freeze — urgent security fixes only — and post-quantum key exchange is TLS 1.3-and-later only. The page said TLS 1.2 was acceptable and left a reader to conclude it was equivalent; it isn't, and the gap grows. Deliberately NOT changed: TLS 1.2 stays acceptable for websites. RFC 9852 (BCP 195) mandates TLS 1.3 for *new protocols*, which is not a statement about site configuration, so it would be an overreach to cite it as pressure on operators. The Mozilla Intermediate profile remains the right default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deploying specification-website with
|
| Latest commit: |
48fdba7
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4eee7766.specification-website.pages.dev |
| Branch Preview URL: | https://fix-tls-rfc9846-citation-dri.specification-website.pages.dev |
jdevalk
marked this pull request as ready for review
July 17, 2026 06:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
src/content/spec/security/https-tls.md:RFC 8446→RFC 9846. The page cited an obsolete RFC as its primary standard.updatedbumped to 2026-07-17.Why now
RFC 9846 — The Transport Layer Security (TLS) Protocol Version 1.3 (July 2026, Standards Track, E. Rescorla) obsoletes RFC 8446, along with 5077, 5246, 6961, 7627 and 8422; it updates 5705 and 6066. It is self-described as "a minor update to TLS 1.3 that retains the same version number and is backward compatible."
This is precisely the dead/stale-citation class the daily scan exists to catch: the page's lead citation pointed at a superseded document, and the body stated it as current fact.
The nuance pass, and why it earns its space
The page said TLS 1.2 "remains acceptable" and stopped there — leaving a reader to conclude it is equivalent. Two July 2026 RFCs say otherwise:
So the honest framing is: keep TLS 1.2 on for the clients that need it, don't plan around it as a destination. That's a real explanation rather than padding — it names the wrong belief the reader arrives with (cardinal rule 7).
What I deliberately did not do
No status change. TLS 1.2 stays acceptable for websites, and the page stays
required.RFC 9852 (BCP 195, July 2026) mandates TLS 1.3 for new protocols and RFC 10015 deprecates obsolete TLS 1.2 key exchange — but neither is a statement about how a website configures its server. Citing them as pressure on site operators would be an overreach, so they're mentioned here for the record and left off the page. The Mozilla Intermediate profile (TLS 1.2 + 1.3) remains the right default for public sites.
Verification
npm run buildpasses (163 pages indexed).npm run format:checkclean; pre-commit skill-drift check passes.Changelog
No entry — this follows the precedent of #93/#94/#95/#101, which shipped citation fixes without one, and per CLAUDE.md the changelog tracks what the spec says, not source hygiene. That said, the TLS 1.2 feature-freeze paragraph is a small substantive addition rather than a pure link swap, so this is borderline — happy to add a
changedentry if you'd rather surface it.🤖 Generated with Claude Code