TLS Certificate Compression
RFC 8879
Internet Engineering Task Force (IETF) A. Ghedini
Request for Comments: 8879 Cloudflare, Inc.
Category: Standards Track V. Vasiliev
ISSN: 2070-1721 Google
December 2020
TLS Certificate Compression
Abstract
In TLS handshakes, certificate chains often take up the majority of
the bytes transmitted.
This document describes how certificate chains can be compressed to
reduce the amount of data transmitted and avoid some round trips.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc8879.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction
2. Notational Conventions
3. Negotiating Certificate Compression
4. Compressed Certificate Message
5. Security Considerations
6. Middlebox Compatibility
7. IANA Considerations
7.1. TLS ExtensionType Values
7.2. TLS HandshakeType
7.3. Compression Algorithms
8. References
8.1. Normative References
8.2. Informative References
Acknowledgements
Authors' Addresses
1. Introduction
In order to reduce latency and improve performance, it can be useful
to reduce the amount of data exchanged during a TLS handshake.
[RFC7924] describes a mechanism that allows a client and a server to
avoid transmitting certificates already shared in an earlier
handshake, but it doesn't help when the client connects to a server
for the first time and doesn't already have knowledge of the server's
certificate chain.
This document describes a mechanism that would allow certificates to
be compressed during all handshakes.
2. Notational Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
3. Negotiating Certificate Compression
This extension is only supported with TLS 1.3 [RFC8446] and newer; if
TLS 1.2 [RFC5246] or earlier is negotiated, the peers MUST ignore
this extension.
This document defines a new extension type
(compress_certificate(27)), which can be used to signal the supported
compression formats for the Certificate message to the peer.
Whenever it is sent by the client as a ClientHello message extension
([RFC8446], Section 4.1.2), it indicates support for compressed
server certificates. Whenever it is sent by the server as a
CertificateRequest extension ([RFC8446], Section 4.3.2), it indicates
support for compressed client certificates.
By sending a compress_certificate extension, the sender indicates to
the peer the certificate-compression algorithms it is willing to use
for decompression. The "extension_data" field of this extension
SHALL contain a CertificateCompressionAlgorithms value:
enum {
zlib(1),
brotli(2),
zstd(3),
(65535)
} CertificateCompressionAlgorithm;
struct {
CertificateCompressionAlgorithm algorithms<2..2^8-2>;
} CertificateCompressionAlgorithms;
The compress_certificate extension is a unidirectional indication; no
corresponding response extension is needed.
4. Compressed Certificate Message
If the peer has indicated that it supports compression, server and
client MAY compress their corresponding Certificate messages
(Section 4.4.2 of [RFC8446]) and send them in the form of the
CompressedCertificate message (replacing the Certificate message).
Show full document text