TLS 1.3 also adds Zero Round-Trip Time Resumption, or 0-RTT. With 0-RTT, the server remembers recently connected clients. The next time those clients connect to the server, they can immediately start sending data without having to perform a handshake. In some tests, 0-RTT improved connection speeds by 34%.

Why Isn't TLS 1.3 More Widespread?

TLS 1.3 is a significant change from 1.2. Because of this, it breaks compatibility with certain middleboxes designed to intercept or monitor TLS-encrypted messages. Many of these middleboxes were created with assumptions about how the TLS protocol would change over time, resulting in connection failures when later versions broke those assumptions.

When the Chrome and Firefox teams tested TLS 1.3 in their respective browsers in early 2017, they found they could only connect to websites 92.3% and 96.1% of the time respectively. To resolve this, libraries like OpenSSL added a compatibility mode that modified TLS 1.3 traffic to look like TLS 1.2 traffic. Although this increased the success rates to 98.8% and 98.37%, both browsers still disable TLS 1.3 by default until these compatibility layers become more widespread.

Performance Compared to TLS 1.2

To see how TLS 1.3 matches up to TLS 1.2, we ran several performance tests on an Nginx server supporting TLS 1.3. Tests were performed on https://enabled.tls13.com, a test site provided by the TLS Workgroup, using Sitespeed.io. We tested both versions on separate instances of Chrome 63.0.3293.132: one with TLS 1.3 enabled (using ECDHE_ECDSA with X25519 for key exchange) and one with it disabled (using X25519 for key exchange). In each browser instance, we made three calls to the site and repeated this step three times.

Overall Metrics

For each of the following metrics, we display the mean value (in milliseconds) calculated by Sitespeed.io:

• FirstPaint: The time until the browser first starts rendering the page.

• BackEndTime: The time required for the server to generate and start sending the HTML.

• ServerResponseTime: The time required for the server to send the response.

• PageLoadTime: The time required for the page to load, from the initial request to load completion in the browser.

TLS 1.2

TLS 1.3

TLS 1.3 showed an average decrease in page load times of 19ms, or 4–5%. The benefits were mostly focused on the encryption and delivery times, since the server response times were consistent across both tests. The test site also didn't support 0-RTT, which could have improved performance even further.

Enabling TLS 1.3

Until encryption libraries include TLS 1.3 by default, you will need to manually enable TLS 1.3 in your web servers.

Apache

Apache supports TLS 1.3 through the OpenSSL 1.1.1 and NSS 3.29 libraries.

When using OpenSSL, add TLSv1.3 to the SSLProtocols line of your server config. If you wish to explicitly specify which ciphersuites to use, add these ciphersuites to the SSLCipherSuite line. Alternatively, you can use the HIGH alias to include all TLS 1.3 ciphersuites.

httpd.conf

<VirtualHost *:443>
    …
    SSLProtocol TLSv1.3
    SSLCipherSuite HIGH
    …
</VirtualHost>

When using NSS, add TLSv1.3 to the NSSProtocol line of your server config.

nss.conf

…
NSSProtocol TLSv1.3
…

Nginx

Nginx (as of version 1.13) supports TLS 1.3 through the OpenSSL 1.1.1 library. To enable it, add TLSv1.3 to the ssl_protocols line of your server config:

nginx.conf

server {
    …
    ssl_protocols    TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
 …
}

Nginx supports the same SSL ciphersuites used by Apache.

Conclusion

TLS 1.3 offers important security and speed improvements over TLS 1.2, but its adoption will likely be slow. Not only do browsers and encryption libraries need to support it, but so will middleboxes designed around quirks in older versions. The protocol already contains "middlebox-friendly" additions added in draft 22, but until there's guaranteed backwards compatibility, it's unlikely that organizations will be rushing to deploy it.

For now, you can check if your network is ready for TLS 1.3 by using CloudFlare's middlebox interference test. You can also check to see if your browser is TLS 1.3-compatible by using Qualys's SSL Client Test. If the Protocol Features box shows TLS 1.3 in green, you're all set. You can also enable TLS 1.2 on your servers alongside TLS 1.3, and clients that don't support the latest version will fall back to a compatible version.