TLS 1.3
The current, fastest and safest TLS version: a one round-trip handshake, forward secrecy by default, optional 0-RTT resumption, and the removal of the weak ciphers that plagued earlier versions.
What it is
TLS 1.3 (RFC 8446) is the encryption layer that secures HTTPS. It reduces the handshake from two round trips to one, removes obsolete algorithms (RSA key exchange, RC4, SHA-1, CBC MACs), and makes forward secrecy mandatory so a stolen private key cannot decrypt past traffic. Optional 0-RTT lets resumed sessions send data immediately.
INSPECT THE HANDSHAKE
openssl s_client -connect example.com:443 -tls1_3 </dev/null 2>/dev/null | grep -i protocol0-RTT and replay
0-RTT early data can be replayed by an attacker. Only send idempotent requests as early data; a server may reject risky ones with 425 Too Early.
Why it matters
- The one round-trip handshake noticeably speeds up HTTPS connection setup.
- Mandatory forward secrecy and the removal of weak ciphers materially improve security.
Common mistakes
- Leaving TLS 1.0/1.1 enabled alongside 1.3, keeping downgrade risk alive.
- Enabling 0-RTT for non-idempotent endpoints and exposing them to replay.
How WebInspect checks this
- WebInspect reports the negotiated TLS version, cipher and whether deprecated versions are still offered.