Using TLS 1.3 with HTTP/2
RFC 8740

Document Type RFC - Proposed Standard (February 2020; No errata)
Updates RFC 7540
Author David Benjamin 
Last updated 2020-02-23
Replaces draft-davidben-http2-tls13
Stream Internet Engineering Task Force (IETF)
Formats plain text html xml pdf htmlized (tools) htmlized bibtex
Stream WG state Submitted to IESG for Publication
Document shepherd Mark Nottingham
Shepherd write-up Show (last changed 2019-09-26)
IESG IESG state RFC 8740 (Proposed Standard)
Action Holders
Consensus Boilerplate Yes
Telechat date
Responsible AD Barry Leiba
Send notices to Mark Nottingham <>
IANA IANA review state IANA OK - No Actions Needed
IANA action state No IANA Actions

Internet Engineering Task Force (IETF)                       D. Benjamin
Request for Comments: 8740                                    Google LLC
Updates: 7540                                              February 2020
Category: Standards Track                                               
ISSN: 2070-1721

                       Using TLS 1.3 with HTTP/2


   This document updates RFC 7540 by forbidding TLS 1.3 post-handshake
   authentication, as an analog to the existing TLS 1.2 renegotiation

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   ( in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction
   2.  Requirements Language
   3.  Post-Handshake Authentication in HTTP/2
   4.  Other Post-Handshake TLS Messages in HTTP/2
   5.  Security Considerations
   6.  IANA Considerations
   7.  References
     7.1.  Normative References
     7.2.  Informative References
   Author's Address

1.  Introduction

   TLS 1.2 [RFC5246] and earlier versions of TLS support renegotiation,
   a mechanism for changing parameters and keys partway through a
   connection.  This was sometimes used to implement reactive client
   authentication in HTTP/1.1 [RFC7230], where the server decides
   whether or not to request a client certificate based on the HTTP

   HTTP/2 [RFC7540] multiplexes multiple HTTP requests over a single
   connection, which is incompatible with the mechanism above.  Clients
   cannot correlate the certificate request with the HTTP request that
   triggered it.  Thus, Section 9.2.1 of [RFC7540] forbids

   TLS 1.3 [RFC8446] removes renegotiation and replaces it with separate
   post-handshake authentication and key update mechanisms.  Post-
   handshake authentication has the same problems with multiplexed
   protocols as TLS 1.2 renegotiation, but the prohibition in [RFC7540]
   only applies to renegotiation.

   This document updates HTTP/2 [RFC7540] to similarly forbid TLS 1.3
   post-handshake authentication.

2.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

3.  Post-Handshake Authentication in HTTP/2

   HTTP/2 servers MUST NOT send post-handshake TLS 1.3
   CertificateRequest messages.  HTTP/2 clients MUST treat such messages
   as connection errors (see Section 5.4.1 of [RFC7540]) of type

   [RFC7540] permitted renegotiation before the HTTP/2 connection
   preface to provide confidentiality of the client certificate.  TLS
   1.3 encrypts the client certificate in the initial handshake, so this
   is no longer necessary.  HTTP/2 servers MUST NOT send post-handshake
   TLS 1.3 CertificateRequest messages before the connection preface.

   The above applies even if the client offered the
   "post_handshake_auth" TLS extension.  This extension is advertised
   independently of the selected Application-Layer Protocol Negotiation
   (ALPN) protocol [RFC7301], so it is not sufficient to resolve the
   conflict with HTTP/2.  HTTP/2 clients that also offer other ALPN
   protocols, notably HTTP/1.1, in a TLS ClientHello MAY include the
   "post_handshake_auth" extension to support those other protocols.
   This does not indicate support in HTTP/2.

4.  Other Post-Handshake TLS Messages in HTTP/2

   [RFC8446] defines two other messages that are exchanged after the
   handshake is complete: KeyUpdate and NewSessionTicket.

   KeyUpdate messages only affect TLS itself and do not require any
   interaction with the application protocol.  HTTP/2 implementations
Show full document text