TLS 1.2 is frozen: post-quantum ships only in TLS 1.3

If anything in your stack still negotiates TLS 1.2, the IETF just told you where that road ends. RFC 9851 — "TLS 1.2 is in Feature Freeze" — landed in July on the Standards Track, authored by Rich Salz of Akamai and Nimrod Aviram. It is short, it is blunt, and it closes the door on the version of TLS that most legacy integrations are still speaking.

What actually happened

The normative line is the whole document: "no changes will be approved for TLS 1.2 outside of urgent security fixes (as determined by TLS Working Group consensus), new TLS Exporter Labels, and new Application-Layer Protocol Negotiation (ALPN) Protocol IDs."

It also reaches into the plumbing. The RFC constrains IANA and the TLS designated experts so that new registry entries approved from here forward are intended for TLS 1.3 or later. The freeze covers TLS specifically — DTLS is not affected.

The reason is stated plainly: post-quantum cryptography will not be specified for TLS 1.2 at any point. If you want PQC, you want TLS 1.3. There is no migration path being held open, no "we'll backport it if adoption demands." The working group picked a lane.

Why frozen TLS 1.2 matters for your business

Nothing broke today. TLS 1.2 is not deprecated, not disabled, not exploitable because of this RFC. What changed is that it became a terminal branch. Every future improvement — hybrid key exchange, ML-KEM, whatever follows — lands in 1.3 and never comes back.

The place this bites a small business is never the marketing site. Cloudflare handled that years ago. It's the boring stuff nobody has opened since it was installed: the payment terminal that pins 1.2, the Java 8 service on a VM, a vendor's SFTP endpoint, a .NET Framework app with ServicePointManager.SecurityProtocol hardcoded in 2017, a network scanner that emails PDFs. Those are what will still be negotiating 1.2 in 2030 — and "harvest now, decrypt later" is a real threat model for anything with a long confidentiality life. Signed contracts, health records, payroll files, source code.

So do the cheap version of this work now. Turn on TLS version logging at your load balancer or CDN and leave it for two weeks. You will get back a ranked list of clients and integrations still on 1.2. That list is your migration backlog, sorted by how much traffic each one represents, and it costs you a config change instead of an audit.

Sources: RFC 9851, IETF, IETF Datatracker.