August 1, 2026
Old locks, new shade
RFC 10015: Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2
Internet rule-makers just told old web locks to retire — and the crowd said, 'Why not just move on?'
TLDR: A new internet standard says several outdated ways of securing TLS 1.2 connections should no longer be used, pushing old web security closer to retirement. The community’s loudest reaction was basically: why are we still talking about this when TLS 1.3 already exists?
The internet standards crowd has dropped a very official breakup text to some very old ways websites secure connections: in plain English, a new IETF standard says certain aging TLS 1.2 handshake methods should be shown the door. That includes old-school RSA key exchange and older forms of Diffie-Hellman, with another older option basically getting a giant "we strongly side-eye this" label. It only applies to TLS 1.2 and its datagram cousin DTLS 1.2, because newer TLS 1.3 already moved on and older versions were already effectively sent to the retirement home.
But the real energy in the room? One brutally simple community reaction that basically hijacked the vibe: "Couldn't folks just use TLS 1.3?" That comment landed like the internet equivalent of showing up to a family argument and asking why everyone doesn’t just move out. It captures the strongest mood perfectly: a mix of impatience, disbelief, and exhausted sysadmin energy. Why are we still doing emotional support for legacy tech in 2026?
That’s the mini-drama here. Standards people are carefully updating a pile of old documents, while the peanut gallery is cutting straight to the chase: stop patching up ancient stuff and upgrade already. It’s less a flame war than a drive-by roast, but it says a lot. The joke underneath the joke is that the internet never really gets to throw anything away quietly — even when everyone agrees it probably should.
Key Points
- •RFC 10015 deprecates finite-field Diffie-Hellman and RSA key exchange methods for TLS 1.2 and DTLS 1.2.
- •The document discourages the use of static ECDH cipher suites in TLS 1.2 and DTLS 1.2.
- •The RFC applies only to (D)TLS 1.2 because (D)TLS 1.0 and TLS 1.1 were already deprecated by RFC 8996, and (D)TLS 1.3 is not affected in the same way.
- •RFC 10015 updates numerous earlier RFCs to deprecate or discourage cipher suites using these key exchange methods in (D)TLS 1.2 connections.
- •The memo is an IETF Standards Track document that reflects IETF consensus and was approved for publication by the IESG.