80 of 80 shown
TLS ExtensionType values and the TLS 1.3 handshake messages each extension may appear in.
| Value | Name | Description | Recommended | References |
|---|---|---|---|---|
0Note | server_name | server_name (extension 0) may appear in TLS 1.3 in ClientHello, EncryptedExtensions, and CertificateRequest. | Y | RFC 6066RFC 9261 |
1 | max_fragment_length | max_fragment_length (extension 1) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | N | RFC 6066RFC 8449 |
2 | client_certificate_url | client_certificate_url (extension 2) is not used in TLS 1.3. | Y | RFC 6066 |
3 | trusted_ca_keys | trusted_ca_keys (extension 3) is not used in TLS 1.3. | Y | RFC 6066 |
4 | truncated_hmac | truncated_hmac (extension 4) is not used in TLS 1.3. | D | RFC 6066IESG Action 2018-08-16RFC 9847Tag Size Does Matter: Attacks and Proofs for the TLS Record Protocol |
5 | status_request | status_request (extension 5) may appear in TLS 1.3 in ClientHello, CertificateRequest, and Certificate. | Y | RFC 6066RFC 9846 |
6 | user_mapping | user_mapping (extension 6) is not used in TLS 1.3. | Y | RFC 4681 |
7 | client_authz | client_authz (extension 7) is not used in TLS 1.3. | N | RFC 5878 |
8 | server_authz | server_authz (extension 8) is not used in TLS 1.3. | N | RFC 5878 |
9 | cert_type | cert_type (extension 9) is not used in TLS 1.3. | N | RFC 6091 |
10Note | supported_groups | supported_groups (extension 10) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. It was previously called elliptic_curves. | Y | RFC 8422RFC 7919RFC 9846 |
11 | ec_point_formats | ec_point_formats (extension 11) is not used in TLS 1.3. | Y | RFC 8422 |
12 | srp | srp (extension 12) is not used in TLS 1.3. | N | RFC 5054 |
13Note | signature_algorithms | signature_algorithms (extension 13) may appear in TLS 1.3 in ClientHello and CertificateRequest. | Y | RFC 9846 |
14 | use_srtp | use_srtp (extension 14) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 5764 |
15 | heartbeat | heartbeat (extension 15) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 6520 |
16Note | application_layer_protocol_negotiation | application_layer_protocol_negotiation (extension 16) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 7301 |
17 | status_request_v2 | status_request_v2 (extension 17) is not used in TLS 1.3. | Y | RFC 6961 |
18 | signed_certificate_timestamp | signed_certificate_timestamp (extension 18) may appear in TLS 1.3 in ClientHello, CertificateRequest, and Certificate. | N | RFC 6962 |
19 | client_certificate_type | client_certificate_type (extension 19) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 7250 |
20 | server_certificate_type | server_certificate_type (extension 20) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 7250 |
21 | padding | padding (extension 21) may appear in TLS 1.3 only in ClientHello. | Y | RFC 7685 |
22 | encrypt_then_mac | encrypt_then_mac (extension 22) is not used in TLS 1.3. | Y | RFC 7366 |
23Note | extended_main_secret | extended_main_secret (extension 23) is not used in TLS 1.3. | Y | RFC 7627RFC 9846 |
24 | token_binding | token_binding (extension 24) is not used in TLS 1.3. | Y | RFC 8472 |
25 | cached_info | cached_info (extension 25) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 7924RFC 9846 |
26 | tls_lts | tls_lts (extension 26) is not used in TLS 1.3. | N | draft-gutmann-tls-lts-11 |
27 | compress_certificate | compress_certificate (extension 27) may appear in TLS 1.3 in ClientHello and CertificateRequest. | Y | RFC 8879 |
28 | record_size_limit | record_size_limit (extension 28) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 8449 |
29 | pwd_protect | pwd_protect (extension 29) may appear in TLS 1.3 only in ClientHello. | N | RFC 8492 |
30 | pwd_clear | pwd_clear (extension 30) may appear in TLS 1.3 only in ClientHello. | N | RFC 8492 |
31 | password_salt | password_salt (extension 31) may appear in TLS 1.3 in ClientHello, ServerHello, and HelloRetryRequest. | N | RFC 8492 |
32 | ticket_pinning | ticket_pinning (extension 32) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | N | RFC 8672 |
33 | tls_cert_with_extern_psk | tls_cert_with_extern_psk (extension 33) may appear in TLS 1.3 in ClientHello and ServerHello. | N | RFC 9973 |
34 | delegated_credential | delegated_credential (extension 34) may appear in TLS 1.3 in ClientHello, CertificateRequest, and Certificate. | Y | RFC 9345 |
35 | session_ticket | session_ticket (extension 35) is not used in TLS 1.3. It was previously called SessionTicket TLS. | Y | RFC 5077RFC 8447 |
36 | TLMSP | TLMSP (extension 36) is not used in TLS 1.3. | N | ETSI TS 103 523-2 |
37 | TLMSP_proxying | TLMSP_proxying (extension 37) is not used in TLS 1.3. | N | ETSI TS 103 523-2 |
38 | TLMSP_delegate | TLMSP_delegate (extension 38) is not used in TLS 1.3. | N | ETSI TS 103 523-2 |
39 | supported_ekt_ciphers | supported_ekt_ciphers (extension 39) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 8870 |
41 | pre_shared_key | pre_shared_key (extension 41) may appear in TLS 1.3 in ClientHello and ServerHello. | Y | RFC 9846 |
42 | early_data | early_data (extension 42) may appear in TLS 1.3 in ClientHello, EncryptedExtensions, and NewSessionTicket. | Y | RFC 9846 |
43 | supported_versions | supported_versions (extension 43) may appear in TLS 1.3 in ClientHello, ServerHello, and HelloRetryRequest. | Y | RFC 9846 |
44 | cookie | cookie (extension 44) may appear in TLS 1.3 in ClientHello and HelloRetryRequest. | Y | RFC 9846 |
45 | psk_key_exchange_modes | psk_key_exchange_modes (extension 45) may appear in TLS 1.3 only in ClientHello. | Y | RFC 9846 |
47 | certificate_authorities | certificate_authorities (extension 47) may appear in TLS 1.3 in ClientHello and CertificateRequest. | Y | RFC 9846 |
48 | oid_filters | oid_filters (extension 48) may appear in TLS 1.3 only in CertificateRequest. | Y | RFC 9846 |
49 | post_handshake_auth | post_handshake_auth (extension 49) may appear in TLS 1.3 only in ClientHello. | Y | RFC 9846 |
50 | signature_algorithms_cert | signature_algorithms_cert (extension 50) may appear in TLS 1.3 in ClientHello and CertificateRequest. | Y | RFC 9846 |
51Note | key_share | key_share (extension 51) may appear in TLS 1.3 in ClientHello, ServerHello, and HelloRetryRequest. | Y | RFC 9846RFC Errata 5483 |
52 | transparency_info | transparency_info (extension 52) may appear in TLS 1.3 in ClientHello, CertificateRequest, and Certificate. | Y | RFC 9162 |
53 | connection_id | connection_id (extension 53) is not used in TLS 1.3. It applies to DTLS only. This code point is deprecated. | D | RFC 9146RFC 9847 |
54 | connection_id | connection_id (extension 54) may appear in TLS 1.3 in ClientHello and ServerHello. It applies to DTLS only. | N | RFC 9146 |
55 | external_id_hash | external_id_hash (extension 55) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 8844 |
56 | external_session_id | external_session_id (extension 56) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 8844 |
57 | quic_transport_parameters | quic_transport_parameters (extension 57) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 9001 |
58 | ticket_request | ticket_request (extension 58) may appear in TLS 1.3 in ClientHello and EncryptedExtensions. | Y | RFC 9149 |
59 | dnssec_chain | dnssec_chain (extension 59) may appear in TLS 1.3 in ClientHello and Certificate. | N | RFC 9102RFC Errata 6860 |
60 | sequence_number_encryption_algorithms | sequence_number_encryption_algorithms (extension 60) may appear in TLS 1.3 in ClientHello, HelloRetryRequest, and ServerHello. It applies to DTLS only. | N | draft-pismenny-tls-dtls-plaintext-sequence-number-01 |
61 | rrc | rrc (extension 61) may appear in TLS 1.3 in ClientHello and ServerHello. It applies to DTLS only. | N | RFC 9853 |
62 | tls_flags | tls_flags (extension 62) may appear in TLS 1.3 in ClientHello, ServerHello, HelloRetryRequest, EncryptedExtensions, CertificateRequest, Certificate, and NewSessionTicket. | N | draft-ietf-tls-tlsflags-14 |
2570 | Reserved | 0x0A0A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
6682 | Reserved | 0x1A1A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
10794 | Reserved | 0x2A2A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
14906 | Reserved | 0x3A3A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
19018 | Reserved | 0x4A4A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
23130 | Reserved | 0x5A5A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
27242 | Reserved | 0x6A6A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
31354 | Reserved | 0x7A7A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
35466 | Reserved | 0x8A8A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
39578 | Reserved | 0x9A9A is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
43690 | Reserved | 0xAAAA is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
47802 | Reserved | 0xBABA is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
51914 | Reserved | 0xCACA is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
56026 | Reserved | 0xDADA is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
60138 | Reserved | 0xEAEA is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
64250 | Reserved | 0xFAFA is a GREASE value (RFC 8701) in the TLS ExtensionType registry: clients send such values at random so that servers learn to ignore unknown entries. It never identifies a real algorithm. | N | RFC 8701 |
64768 | ech_outer_extensions | ech_outer_extensions (extension 64768) may appear in TLS 1.3 only in ClientHello. | Y | RFC 9849 |
65037Note | encrypted_client_hello | encrypted_client_hello (extension 65037) may appear in TLS 1.3 in ClientHello, HelloRetryRequest, and EncryptedExtensions. | Y | RFC 9849 |
65281 | renegotiation_info | renegotiation_info (extension 65281) is not used in TLS 1.3. | Y | RFC 5746 |
| Range | Status | Description |
|---|---|---|
| 0x0028 | reserved | Reserved |
| 0x002E | reserved | Reserved |
| 0x003F–0x0A09 | unassigned | Unassigned |
| 0x0A0B–0x1A19 | unassigned | Unassigned |
| 0x1A1B–0x2A29 | unassigned | Unassigned |
| 0x2A2B–0x3A39 | unassigned | Unassigned |
| 0x3A3B–0x4A49 | unassigned | Unassigned |
| 0x4A4B–0x5A59 | unassigned | Unassigned |
| 0x5A5B–0x6A69 | unassigned | Unassigned |
| 0x6A6B–0x7A79 | unassigned | Unassigned |
| 0x7A7B–0x8A89 | unassigned | Unassigned |
| 0x8A8B–0x9A99 | unassigned | Unassigned |
| 0x9A9B–0xAAA9 | unassigned | Unassigned |
| 0xAAAB–0xBAB9 | unassigned | Unassigned |
| 0xBABB–0xCAC9 | unassigned | Unassigned |
| 0xCACB–0xDAD9 | unassigned | Unassigned |
| 0xDADB–0xEAE9 | unassigned | Unassigned |
| 0xEAEB–0xFAF9 | unassigned | Unassigned |
| 0xFAFB–0xFCFF | unassigned | Unassigned |
| 0xFD01–0xFE0C | unassigned | Unassigned |
| 0xFE0E–0xFEFF | unassigned | Unassigned |
| 0xFF00 | private | Reserved for Private Use |
| 0xFF02–0xFFFF | private | Reserved for Private Use |
Source: Transport Layer Security (TLS) Parameters (IANA), retrieved 2026-10-20. Data license: CC0-1.0. TLS ExtensionType Values
server_name (SNI) names the host the client wants, so one IP address can serve many certificates.
The client sends the host name in clear text in its ClientHello (RFC 6066 §3). Without it a server with several sites cannot know which certificate to present, which is why connecting by IP address often returns a default certificate. Encrypted Client Hello (RFC 9849) hides the real name inside an encrypted inner ClientHello.
supported_groups lists the key-exchange groups a client accepts — elliptic curves, finite-field groups and post-quantum hybrids.
Formerly called elliptic_curves, extension 10 was generalised by RFC 7919 to cover finite-field groups. In TLS 1.3 it works together with key_share: the client lists the groups it accepts here and sends shares for some of them; if the server prefers a listed group without a share, it answers with a HelloRetryRequest.
signature_algorithms lists the signature schemes the peer may use to sign the handshake.
In TLS 1.3 it lists the schemes acceptable for CertificateVerify and, unless signature_algorithms_cert is present, for certificates too. A server with no certificate matching the client's list fails the handshake.
ALPN agrees on the application protocol (h2, http/1.1) during the TLS handshake.
Extension 16 (RFC 7301) lets the client offer protocols such as h2 and http/1.1 and the server choose one, saving a round trip. HTTP/2 over TLS is negotiated only through ALPN.
extended_main_secret binds the TLS 1.2 master secret to the handshake transcript, fixing the triple-handshake attack.
Extension 23 was introduced as extended_master_secret by RFC 7627 after the 2014 triple-handshake attack, in which two sessions could be made to share a master secret. The name changed to extended_main_secret in RFC 9846. TLS 1.3 binds its secrets to the transcript by design.
key_share carries the client's and the server's Diffie–Hellman or KEM shares in TLS 1.3.
Sending shares in the first flight lets TLS 1.3 finish the handshake in one round trip. Clients usually send one or two shares (for example X25519MLKEM768 and X25519); if none matches a group the server accepts, a HelloRetryRequest costs an extra round trip.
encrypted_client_hello (ECH) encrypts the ClientHello, including the server name, with a key published in DNS.
ECH (RFC 9849) wraps the real ClientHello in an outer one that names a shared front end. The inner ClientHello is encrypted with HPKE to a key the server publishes in an ECHConfig, typically delivered in the HTTPS DNS record, so observers on the network see only the public name.