A defensible TLS baseline is short: TLS 1.2 and 1.3 only, AEAD cipher suites with forward secrecy, RSA keys of at least 2048 bits, no SHA-1 signatures, and strict certificate validation on clients. RFC 9325 sets these out, and you can turn them into a checklist for every endpoint.
Versions
- Do not negotiate SSL 2.0, SSL 3.0, TLS 1.0 or TLS 1.1.
- Support TLS 1.2. Support TLS 1.3 and prefer it where you implement it.
- TLS 1.2 clients must not fall back to earlier versions.
- New transport protocols should use TLS 1.3 only.
Cipher suites for TLS 1.2
RFC 9325 recommends AEAD suites using ECDHE with RSA or ECDSA certificates and AES-GCM. It forbids NULL encryption, RC4 and anything under 112 bits of security. It says you should not negotiate static RSA key transport or static DH and ECDH, and that CBC suites should be avoided unless encrypt-then-MAC is negotiated.
For TLS 1.3 the document points to the suite list in RFC 8446, so you do not tune much there.
Forward secrecy and session tickets
Implementations must support and prefer suites with forward secrecy. The RFC adds a detail teams miss: session ticket keys must be rotated regularly, for example weekly, and old keys destroyed. A server that never rotates its ticket key weakens the forward secrecy you paid for.
Key sizes
- RSA modulus: at least 2048 bits on servers.
- Elliptic curves: nothing under 224 bits. P-256 and X25519 are recommended.
- Finite field DH groups: at least 2048 bits, though the RFC says to avoid ephemeral finite field suites in TLS 1.2.
- No MD5 or SHA-1 for signatures.
Certificate checks on the client side
Clients must verify the full certification path. Host name validation is called security critical, because without it the connection may not end at the intended server. This is the bug that turns up in custom HTTP clients that disable verification to make a test pass. Read certificate validation bypass and man-in-the-middle risk if you have found a verify=False in your code.
Implementations also need a strategy to distrust revoked certificates. Servers should support OCSP stapling, and Must-Staple is optional, so review operations before using it. Note that some public CAs have since stopped running OCSP, covered in OCSP at Let's Encrypt has ended.
Other items
- TLS 1.2 needs secure renegotiation info and extended master secret.
- Avoid 0-RTT unless a specification for your application protocol says when it is safe.
- Servers should send the unrecognized_name alert for unknown server names.
- Web servers should use HSTS unless doing so weakens security.
Turn it into a check
Pick one scanner, run it against each public hostname, store the result with a date, and re-run after any load balancer or CDN change. A baseline that nobody re-tests drifts.
Quick check
Do I need to hand pick cipher suites for TLS 1.3?
Usually not. The suite list is short and fixed by the protocol, so most operators leave defaults on.
Is 2048 bit RSA still acceptable?
RFC 9325 sets 2048 bits as the minimum modulus for servers. Check any framework you are subject to for stricter requirements.
Sources
Last reviewed: 19 October 2026.
