{"id":9457,"date":"2016-11-12T00:31:16","date_gmt":"2016-11-11T23:31:16","guid":{"rendered":"https:\/\/daniel.haxx.se\/blog\/?p=9457"},"modified":"2016-11-12T00:33:35","modified_gmt":"2016-11-11T23:33:35","slug":"curl-and-tls-1-3","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2016\/11\/12\/curl-and-tls-1-3\/","title":{"rendered":"curl and TLS 1.3"},"content":{"rendered":"

Draft 18 of the TLS version 1.3 spec<\/a> was publi\"SSLshed at the end of October 2016.<\/p>\n

Already now, both Firefox and Chrome have test versions out with TLS 1.3 enabled. Firefox 52<\/a> will have it by default, and while Chrome will ship it,<\/a> I couldn’t figure out exactly when we can expect it to be there by default.<\/p>\n

Over the last few days we’ve merged TLS 1.3 support to curl, primarily in this commit<\/a> by Kamil Dudka<\/a>. Both the command line tool and libcurl will negotiate TLS 1.3 in the next version (7.52.0 – planned release date at the end of December 2016) if built with a TLS library that supports it and told to do it by the user.<\/p>\n

The two current TLS libraries that will speak TLS 1.3 when built with curl right now is NSS<\/a> and BoringSSL<\/a>. The plan is to gradually adjust curl over time as the other libraries start to support 1.3 as well. As always we will appreciate your help in making this happen!<\/p>\n

Right now, there’s also the minor flux in that servers and clients may end up running implementations of different draft versions of the TLS spec which contributes to a layer of extra fun!<\/p>\n

Three TLS current 1.3 test servers to play with: https:\/\/enabled.tls13.com\/<\/a> , https:\/\/www.allizom.org\/<\/a> and https:\/\/tls13.crypto.mozilla.org\/<\/a>. I doubt any of these will give you any guarantees of functionality.<\/p>\n

TLS 1.3 offers a few new features that allow clients such as curl to do subsequent TLS connections much faster, with only 1 or even 0 RTTs, but curl has no code for any of those features yet.<\/p>\n","protected":false},"excerpt":{"rendered":"

Draft 18 of the TLS version 1.3 spec was published at the end of October 2016. Already now, both Firefox and Chrome have test versions out with TLS 1.3 enabled. Firefox 52 will have it by default, and while Chrome will ship it, I couldn’t figure out exactly when we can expect it to be … Continue reading curl and TLS 1.3<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,393,13,6,133],"tags":[392,292,33,86,44,381],"class_list":["post-9457","post","type-post","status-publish","format-standard","hentry","category-curl","category-firefox-floss","category-net","category-floss","category-security","tag-boringssl","tag-chrome","tag-curl-and-libcurl","tag-firefox","tag-nss","tag-tls"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/9457","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=9457"}],"version-history":[{"count":8,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/9457\/revisions"}],"predecessor-version":[{"id":9471,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/9457\/revisions\/9471"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=9457"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=9457"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=9457"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}