RFC 10015: RSA and DHE Are Dead in TLS 1.2 — Fix It Now

The IETF published RFC 10015 in July 2026, formally deprecating RSA key exchange and both variants of finite-field Diffie-Hellman — DH and DHE — in TLS 1.2 and DTLS 1.2. Over 150 cipher suites are now “MUST NOT use” in any conforming TLS 1.2 implementation. If your server is running default cipher configurations from five years ago, it is almost certainly non-compliant. The good news: TLS 1.2 itself is not being retired. The broken pieces of it are.

RFC 10015: What’s Deprecated in TLS 1.2

RFC 10015 targets three key exchange mechanisms. RSA key exchange — where the client encrypts a premaster secret with the server’s RSA public key — is now MUST NOT. Non-ephemeral DH over finite fields (TLS_DH_* cipher suites) is MUST NOT. Ephemeral DHE over finite fields (TLS_DHE_* cipher suites) is also MUST NOT. The RFC language is unambiguous: “Clients MUST NOT offer and servers MUST NOT select” these cipher suites in TLS 1.2 connections.

ECDHE — ephemeral elliptic-curve Diffie-Hellman — is not deprecated and remains the correct key exchange for TLS 1.2. This is a critical distinction. DHE and ECDHE sound similar but are not equivalent: DHE operates over finite fields and carries the vulnerabilities RFC 10015 targets, while ECDHE operates over elliptic curves and avoids them. Static ECDH gets a SHOULD NOT (discouraged but not prohibited). TLS 1.3 is entirely unaffected because it already eliminated all three deprecated mechanisms by design.

Why These Cipher Suites Are Being Killed

The deprecations are driven by two attack classes with real CVEs and proof-of-concept exploits. The Raccoon attack targets FFDH and FFDHE. TLS 1.2 requires stripping leading zeroes from the premaster secret before hashing it — and that stripping operation takes measurably different time depending on the value. An active attacker with oracle access can exploit that timing difference to recover the session key. Ephemeral DHE was supposed to provide forward secrecy, but Raccoon demonstrates that ephemerality does not eliminate the timing side-channel.

RSA key exchange falls to Bleichenbacher’s attack, first demonstrated in 1998 and still producing new variants 28 years later. ROBOT (2017) and multiple other real-world exploits followed the same pattern: any error or timing oracle in the RSA decryption path allows an adaptive chosen-ciphertext attack against the premaster secret. Every implementation countermeasure has eventually been bypassed. RFC 10015 concludes the only fix is removing RSA key exchange entirely — not patching implementations.

Related: Claude Breaks Post-Quantum HAWK Cipher in Just 60 Hours

Fix Your TLS 1.2 Cipher Suite Config

The safe TLS 1.2 cipher suite list post-RFC 10015 is short: ECDHE + AEAD only. This matches Mozilla’s Intermediate SSL configuration profile, which is the right default for most production servers. For nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

All six cipher suites above use ECDHE for key exchange and AEAD algorithms (AES-GCM or ChaCha20-Poly1305) for authenticated encryption. Remove older cipher strings like DHE-RSA-AES256-SHA, TLS_RSA_WITH_AES_128_CBC_SHA, and anything beginning with TLS_DH_ from your configuration entirely.

Before touching configs, run this test to confirm whether your server still accepts RSA key exchange:

openssl s_client -connect yourhost.com:443 -cipher "RSA" 2>&1 | grep -E "CONNECTED|handshake failure"

If the output says CONNECTED, RSA key exchange is still active and your server is non-compliant with RFC 10015. A handshake failure is the expected result after you update your cipher list.

The Legacy Client Problem

The Hacker News discussion around RFC 10015 immediately surfaced the backward compatibility tension. Java 7 and 8 clients negotiate DHE or RSA cipher suites and will break against servers enforcing the new standard. Older embedded and IoT devices with fixed TLS stacks face the same problem. However, for public-facing APIs that must support legacy clients, the migration path requires more care: audit your actual client inventory before removing cipher suites, and set a deprecation deadline for those clients.

For internal services and modern client stacks, there is no reason to delay. Peers enforcing RFC 10015 will refuse handshakes from clients offering deprecated cipher suites as a downgrade-attack prevention measure. Even if your own clients could negotiate something older, compliant servers on the other end will not allow it.

Key Takeaways

• RFC 10015 (July 2026) makes RSA key exchange, DH, and DHE cipher suites MUST NOT in TLS 1.2 — over 150 cipher suites are now deprecated
• ECDHE is not deprecated; ECDHE paired with AEAD (AES-GCM or ChaCha20-Poly1305) is the safe and compliant TLS 1.2 configuration
• Raccoon attack on FFDHE and Bleichenbacher variants on RSA key exchange are real, exploitable attack classes — this is not bureaucratic cleanup
• Run openssl s_client -cipher "RSA" against your server before touching configs — if it connects, you have work to do
• Legacy Java 7/8 and IoT clients that only support DHE or RSA cipher suites will break against RFC 10015-compliant servers; audit before enforcing