--- title: Enabling TLS 1.3 through Fastly summary: null url: >- https://www.fastly.com/documentation/guides/getting-started/domains/securing-domains/enabling-tls-1-3-through-fastly --- > **IMPORTANT:** TLS 1.3 is now the default TLS version. You only need to follow the instructions in this guide if you created your account on or before June 29, 2020. This guide describes how to use [Fastly TLS](https://docs.fastly.com/products/tls-service-options#fastly-tls) to enable TLS 1.3 for a domain using a TLS certificate you provide or one that Fastly provides and manages. ## About TLS 1.3 To serve secure, encrypted traffic from Fastly using the Hypertext Transfer Protocol Secure (HTTPS) protocol, a website or application must provide a valid TLS certificate that is digitally signed by a trusted certification authority. Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are the protocols that allow clients to form secure communication connections between web browsers or applications and the servers they request information from. TLS 1.3, the newest version of the TLS protocol, was designed to improve the performance and security of traffic for HTTPS domains. Specifically, this version of the protocol was designed to help speed up encrypted connections to servers by eliminating an entire round trip from its connection establishment handshake. The Zero Round Trip Time (0-RTT) feature can reduce the latency of resumed connections by encrypting requests in the initial ClientHello, a step in the client handshake process that specifies the maximum protocol version the client wishes to support. In addition, TLS 1.3 allows only cipher suites that offer [Perfect Forward Secrecy (PFS)](https://en.wikipedia.org/wiki/Forward_secrecy) for securing and encrypting traffic. TLS 1.3 also specifically prohibits TLS renegotiation, a process that allows changing the details of a TLS handshake after a connection has already been established with the server. Both restrictions make TLS 1.3 more secure than previous versions of the protocol. ## When to use the Fastly control panel and when to contact Support You can only enable TLS 1.3 via the Fastly control panel if you have purchased or are using: - [Fastly TLS](https://docs.fastly.com/products/tls-service-options#fastly-tls), - [Concierge TLS](https://docs.fastly.com/products/tls-service-options#concierge-tls), or - Fastly's [Legacy Customer-Provided TLS Certificate Hosting Service](https://docs.fastly.com/products/legacy-customer-provided-tls-certificate-hosting-service) and your domains have not been configured on [Dedicated IP addresses](https://docs.fastly.com/products/dedicated-ip-addresses) that Fastly maintains and manages for you. If you have purchased or are using [Platform TLS](https://docs.fastly.com/products/platform-tls) or [Dedicated IP addresses](https://docs.fastly.com/products/dedicated-ip-addresses), or you have custom domain mapping in place, you must [contact support](https://support.fastly.com) and have them enable TLS 1.3 for you. ## Limitations and key behaviors Before enabling or requesting this functionality, keep the following in mind: - Negotiation of the TLS protocol will only happen if the requesting client also supports TLS 1.3. If a request comes from an older client, Fastly’s default behavior is to downgrade to TLS 1.2. - Fastly only supports 0-RTT between Fastly and requesting clients. We do not support 0-RTT between Fastly and your origin servers. - By default, Fastly only answers idempotent requests (GET and HEAD requests without query parameters) over 0-RTT. This helps protect customer applications from [replay attacks](https://en.wikipedia.org/wiki/Replay_attack). - Requests issued with 0-RTT will include an `Early-Data:1` header per [RFC 8470](https://httpwg.org/specs/rfc8470.html). This attribute can be queried and logged via VCL using `req.http.early-data`. ## Setting up TLS 1.3 for a new domain Setting up TLS for a domain requires you to secure the domain by registering it with a certification authority. If you have your own TLS certificates, follow the instructions in the guide to [uploading and deploying your own certificates](https://www.fastly.com/documentation/guides/getting-started/domains/securing-domains/setting-up-tls-with-your-own-certificates). If you'd rather have Fastly manage your certificate, follow the instructions in [Fastly-managed subscriptions guide](https://www.fastly.com/documentation/guides/getting-started/domains/securing-domains/setting-up-tls-with-certificates-fastly-manages/#setting-up-tls-for-a-domain), making sure to select a TLS configuration with TLS 1.3. ## Applying TLS 1.3 to an existing domain To migrate an existing domain to a new TLS 1.3 configuration, follow these steps: 1. Log in to the [Fastly control panel](https://manage.fastly.com). 2. Go to [**Domains**](https://manage.fastly.com/domains). 3. Click the name of the domain you want to migrate. 4. From the domain details, click the **TLS** tab. 5. Click **View DNS details**. 6. From the **Add TLS configuration** menu, select one of the following: - Activate **HTTP/3 & TLS v1.3** to apply the latest version of the protocol, but without 0-RTT - Activate **HTTP/3 & TLS v1.3 + 0RTT** to apply the latest version of the protocol with 0-RTT.