RFC 9846, published in July 2026, obsoletes RFC 8446 as the specification for TLS 1.3. It is a minor revision in that it is backward compatible, but it tightens a number of requirements that were previously advisory. At wolfSSL, we are working hard on implementing the specification.
No KeyUpdate while sending early data. Section 5.5 now says explicitly that a KeyUpdate cannot be performed for early data, so a sender MUST NOT exceed the AEAD key usage limits while sending it. wolfSSL’s CheckTLS13AEADSendLimit() previously drove the ordinary rekey path at the limit, which on a client mid-0-RTT emits a KeyUpdate before the handshake has finished. That case now fails the write with TOO_MUCH_EARLY_DATA instead.
user_canceled no longer kills the connection. Section 6.1 clarifies that this alert only generally carries AlertLevel=warning, and that receivers should keep reading until a close_notify arrives. The AlertLevel byte is meaningless in TLS 1.3 anyway. wolfSSL already exempted user_canceled from the “all error alerts are fatal” rule, but sometimes evicted the session. This is no longer the case. TLS 1.2 behavior is unchanged.
The KeyUpdate cap is no longer a connection killer. Section 4.7.3 caps a sender at 2^48−1 key updates and adds that a sender at the cap MUST NOT send its own KeyUpdate and should instead ignore the peer’s update_requested flag. wolfSSL enforced the cap but let the resulting BAD_STATE_E propagate out of the receive path, killing the connection. The check is now factored into Tls13KeyUpdateLimitReached(). DTLS 1.3 is excluded, since RFC 9147 bounds the epoch instead.
Malformed extensions now get an alert. Section 4.3 forbids trailing data in an extension and requires a decode_error alert when the structure does not consume its extension_data. wolfSSL’s parsers detected those cases, but sometimes reported invalid_alert, which every caller reads as “send nothing” — so the handshake aborted correctly but silently, and the peer saw a dropped connection with no diagnostic. Now the peer will see a decode_error alert.
Warnings when enabling old TLS and SSL versions. RFC 9846 states that SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 must not be negotiated for any reason (Appendix E.5). The –enable-sslv3, –enable-tlsv10 and –enable-oldtls help strings now spell out which RFCs the option violates. By default, these versions are disabled and we do NOT suggest they be enabled, but some customers do need these for interoperability.
There will still be more changes to come based on RFC 9846 so please do stay tuned to our blog for the latest updates.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now