Internet Assigned Numbers Authority • Domains • Protocols • Numbers • About Transport Layer Security (TLS) Extensions Created 2005-11-15 Last Updated 2026-10-08 Related Registry Group(s) [Transport Layer Security (TLS) Parameters] Available Formats [IMG] XML [IMG] HTML [IMG] TXT Registries Included Below • TLS ExtensionType Values • TLS Certificate Types • TLS Certificate Status Types • TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs • TLS CachedInformationType Values • TLS Certificate Compression Algorithm IDs TLS ExtensionType Values Expert(s) Yoav Nir, Rich Salz, Nick Sullivan Reference [RFC 9846][RFC 8447][RFC 9146][RFC 9851][RFC 9847] Note If the "Specification Required" [RFC 8126] procedure applies, registration requests can be sent to iana@iana.org or submitted via IANA's [application form], per [RFC 9847]. IANA will forward the submission to the expert mailing list described in [RFC 8447, Section 17] and track its progress. See the registration procedure table below for more information. Note The role of the designated expert is described in [RFC 8447]. The designated expert [RFC 8126] ensures that the specification is publicly available. It is sufficient to have an Internet-Draft (that is posted and never published as an RFC) or a document from another standards body, industry consortium, university site, etc. The expert may provide more in-depth reviews, but their approval should not be taken as an endorsement of the extension. Note As specified in [RFC 8126], assignments made in the Private Use space are not generally useful for broad interoperability. It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available. Note If the "Recommended" column is set to "N", it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. If the "Recommended" column is set to "D," the item is discouraged and SHOULD NOT or MUST NOT be used, depending upon the situation; consult the item's references for clarity. Note Abbreviations that may appear in the "TLS 1.3" field include "CH" (ClientHello), "SH" (ServerHello), "EE" (EncryptedExtensions), "CT" (Certificate), "CR" (CertificateRequest), "NST" (NewSessionTicket), and "HRR" (HelloRetryRequest). Note The addition of the "CR" to the "TLS 1.3" column for the server_name(0) extension only marks the extension as valid in a ClientCertificateRequest created as part of client-generated authenticator requests. Note Any TLS entry added after the IESG approves publication of [RFC 9851] is intended for TLS 1.3 or later, and makes no similar requirement on DTLS. Such entries should have an informal indication like "For TLS 1.3 or later" in that entry, such as the "Comment" column. Available Formats [IMG] CSV Range Registration Procedures "Recommended" set to/transitioning from "Y" or "D" Either Standards Action With Expert Review or IESG Approval "Recommended" set to "N," not transitioning from another value Specification Required Value Extension Name TLS 1.3 DTLS-Only Recommended Reference Comment 0 server_name CH, EE, CR N Y [RFC 6066][RFC 9261] 1 max_fragment_length CH, EE N N [RFC 6066][RFC 8449] 2 client_certificate_url - N Y [RFC 6066] 3 trusted_ca_keys - N Y [RFC 6066] [RFC 6066][IESG Action 2018-08-16][RFC 9847][Tag Size 4 truncated_hmac - N D Does Matter: Attacks and Proofs for the TLS Record Protocol] 5 status_request CH, CR, CT N Y [RFC 6066][RFC 9846] 6 user_mapping - N Y [RFC 4681] 7 client_authz - N N [RFC 5878] 8 server_authz - N N [RFC 5878] 9 cert_type - N N [RFC 6091] 10 supported_groups (renamed from CH, EE N Y [RFC 8422][RFC 7919][RFC 9846] "elliptic_curves") 11 ec_point_formats - N Y [RFC 8422] 12 srp - N N [RFC 5054] 13 signature_algorithms CH, CR N Y [RFC 9846] 14 use_srtp CH, EE N Y [RFC 5764] 15 heartbeat CH, EE N Y [RFC 6520] 16 application_layer_protocol_negotiation CH, EE N Y [RFC 7301] 17 status_request_v2 - N Y [RFC 6961] 18 signed_certificate_timestamp CH, CR, CT N N [RFC 6962] 19 client_certificate_type CH, EE N Y [RFC 7250] 20 server_certificate_type CH, EE N Y [RFC 7250] 21 padding CH N Y [RFC 7685] 22 encrypt_then_mac - N Y [RFC 7366] 23 extended_main_secret - N Y [RFC 7627][RFC 9846] 24 token_binding - N Y [RFC 8472] 25 cached_info CH, EE N Y [RFC 7924][RFC 9846] 26 tls_lts - N N [draft-gutmann-tls-lts-11] 27 compress_certificate CH, CR N Y [RFC 8879] 28 record_size_limit CH, EE N Y [RFC 8449] 29 pwd_protect CH N N [RFC 8492] 30 pwd_clear CH N N [RFC 8492] 31 password_salt CH, SH, HRR N N [RFC 8492] 32 ticket_pinning CH, EE N N [RFC 8672] 33 tls_cert_with_extern_psk CH, SH N N [RFC 9973] 34 delegated_credential CH, CR, CT N Y [RFC 9345] 35 session_ticket (renamed from - N Y [RFC 5077][RFC 8447] "SessionTicket TLS") 36 TLMSP - N N [ETSI TS 103 523-2] 37 TLMSP_proxying - N N [ETSI TS 103 523-2] 38 TLMSP_delegate - N N [ETSI TS 103 523-2] 39 supported_ekt_ciphers CH, EE N Y [RFC 8870] 40 Reserved D [RFC 9847][tls-reg-review mailing list] 41 pre_shared_key CH, SH N Y [RFC 9846] 42 early_data CH, EE, NST N Y [RFC 9846] 43 supported_versions CH, SH, HRR N Y [RFC 9846] 44 cookie CH, HRR N Y [RFC 9846] 45 psk_key_exchange_modes CH N Y [RFC 9846] 46 Reserved D [RFC 9847][tls-reg-review mailing list] 47 certificate_authorities CH, CR N Y [RFC 9846] 48 oid_filters CR N Y [RFC 9846] 49 post_handshake_auth CH N Y [RFC 9846] 50 signature_algorithms_cert CH, CR N Y [RFC 9846] 51 key_share CH, SH, HRR N Y [RFC 9846][RFC Errata 5483] 52 transparency_info CH, CR, CT N Y [RFC 9162] 53 connection_id (deprecated) - Y D [RFC 9146][RFC 9847] 54 connection_id CH, SH Y N [RFC 9146] 55 external_id_hash CH, EE N Y [RFC 8844] 56 external_session_id CH, EE N Y [RFC 8844] 57 quic_transport_parameters CH, EE N Y [RFC 9001] 58 ticket_request CH, EE N Y [RFC 9149] 59 dnssec_chain CH, CT N N [RFC 9102][RFC Errata 6860] 60 sequence_number_encryption_algorithms CH, HRR, SH Y N [draft-pismenny-tls-dtls-plaintext-sequence-number-01] 61 rrc CH, SH Y N [RFC 9853] 62 tls_flags CH,SH,HRR,EE,CR,CT,NST N N [draft-ietf-tls-tlsflags-14] 63-2569 Unassigned 2570 Reserved CH, CR, NST N N [RFC 8701] 2571-6681 Unassigned 6682 Reserved CH, CR, NST N N [RFC 8701] 6683-10793 Unassigned 10794 Reserved CH, CR, NST N N [RFC 8701] 10795-14905 Unassigned 14906 Reserved CH, CR, NST N N [RFC 8701] 14907-19017 Unassigned 19018 Reserved CH, CR, NST N N [RFC 8701] 19019-23129 Unassigned 23130 Reserved CH, CR, NST N N [RFC 8701] 23131-27241 Unassigned 27242 Reserved CH, CR, NST N N [RFC 8701] 27243-31353 Unassigned 31354 Reserved CH, CR, NST N N [RFC 8701] 31355-35465 Unassigned 35466 Reserved CH, CR, NST N N [RFC 8701] 35467-39577 Unassigned 39578 Reserved CH, CR, NST N N [RFC 8701] 39579-43689 Unassigned 43690 Reserved CH, CR, NST N N [RFC 8701] 43691-47801 Unassigned 47802 Reserved CH, CR, NST N N [RFC 8701] 47803-51913 Unassigned 51914 Reserved CH, CR, NST N N [RFC 8701] 51915-56025 Unassigned 56026 Reserved CH, CR, NST N N [RFC 8701] 56027-60137 Unassigned 60138 Reserved CH, CR, NST N N [RFC 8701] 60139-64249 Unassigned 64250 Reserved CH, CR, NST N N [RFC 8701] 64251-64767 Unassigned Only appears 64768 ech_outer_extensions CH N Y [RFC 9849] in inner CH. 64769-65036 Unassigned 65037 encrypted_client_hello CH, HRR, EE N Y [RFC 9849] 65038-65279 Unassigned 65280 Reserved for Private Use [RFC 9846] 65281 renegotiation_info - N Y [RFC 5746] 65282-65535 Reserved for Private Use [RFC 9846] TLS Certificate Types Expert(s) Yoav Nir, Rich Salz, Nick Sullivan Reference [RFC 6091][RFC 9846][RFC 8447][RFC 9851][RFC 9847] Note If the "Specification Required" [RFC 8126] procedure applies, registration requests can be sent to iana@iana.org or submitted via IANA's [application form], per [RFC 9847]. IANA will forward the submission to the expert mailing list described in [RFC 8447, Section 17] and track its progress. See the registration procedure table below for more information. Note The role of the designated expert is described in [RFC 8447]. The designated expert [RFC 8126] ensures that the specification is publicly available. It is sufficient to have an Internet-Draft (that is posted and never published as an RFC) or a document from another standards body, industry consortium, university site, etc. The expert may provide more in-depth reviews, but their approval should not be taken as an endorsement of the certificate type. Note If the "Recommended" column is set to "N", it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. If the "Recommended" column is set to "D," the item is discouraged and SHOULD NOT or MUST NOT be used, depending upon the situation; consult the item's references for clarity. Note Any TLS entry added after the IESG approves publication of [RFC 9851] is intended for TLS 1.3 or later, and makes no similar requirement on DTLS. Such entries should have an informal indication like "For TLS 1.3 or later" in that entry, such as the "Comment" column. Available Formats [IMG] CSV Range Registration Procedures "Recommended" set to/transitioning from "Y" or "D" Either Standards Action With Expert Review or IESG Approval "Recommended" set to "N," not transitioning from another value Specification Required Value Name Recommended Reference Comment 0 X509 Y [RFC 6091][RFC Errata 5976] Was X.509 before TLS 1.3. 1 OpenPGP_RESERVED N [RFC 6091][RFC 9846] Used in TLS versions prior to 1.3. 2 Raw Public Key Y [RFC 7250] 3 1609Dot2 N [RFC 8902] 4 C509 Certificate N [RFC-ietf-cose-cbor-encoded-cert-20] 5-223 Unassigned 224-255 Reserved for Private Use [RFC 6091] TLS Certificate Status Types Registration Procedure(s) IETF Review Reference [RFC 6961][RFC 9846][RFC 9851][RFC 9847] Note Any TLS entry added after the IESG approves publication of [RFC 9851] is intended for TLS 1.3 or later, and makes no similar requirement on DTLS. Such entries should have an informal indication like "For TLS 1.3 or later" in that entry, such as the "Comment" column. Available Formats [IMG] CSV Value Description Reference Comment 0 Reserved [RFC 6961] 1 ocsp [RFC 6066][RFC 6961] 2 ocsp_multi_RESERVED [RFC 6961][RFC 9846] Used in TLS versions prior to 1.3. 3-255 Unassigned TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs Registration Procedure(s) Expert Review Expert(s) Yoav Nir, Rich Salz, Nick Sullivan Reference [RFC 7301][RFC 8447][RFC 9847] Note Registration requests should be sent to iana@iana.org or submitted via IANA's [application form], per [RFC 9847]. IANA will forward the request to the expert mailing list described in [RFC 8447, Section 17] and track its progress. Note When this registry has an HTTP-specific version added or modified, the YANG module [iana-http-versions] must be updated as defined in [RFC-ietf-netconf-http-client-server-31]. Available Formats [IMG] CSV Protocol Identification Sequence Reference Comment Reserved 0x0A 0x0A [RFC 8701] Reserved 0x1A 0x1A [RFC 8701] Reserved 0x2A 0x2A [RFC 8701] Reserved 0x3A 0x3A [RFC 8701] Reserved 0x4A 0x4A [RFC 8701] Reserved 0x5A 0x5A [RFC 8701] Reserved 0x6A 0x6A [RFC 8701] Reserved 0x7A 0x7A [RFC 8701] Reserved 0x8A 0x8A [RFC 8701] Reserved 0x9A 0x9A [RFC 8701] Reserved 0xAA 0xAA [RFC 8701] Reserved 0xBA 0xBA [RFC 8701] Reserved 0xCA 0xCA [RFC 8701] Reserved 0xDA 0xDA [RFC 8701] Reserved 0xEA 0xEA [RFC 8701] Reserved 0xFA 0xFA [RFC 8701] 0x68 0x74 0x74 0x70 0x2f HTTP/0.9 0x30 0x2e 0x39 [RFC 1945] ("http/0.9") 0x68 0x74 0x74 0x70 0x2f HTTP/1.0 0x31 0x2e 0x30 [RFC 1945] ("http/1.0") 0x68 0x74 0x74 0x70 0x2f HTTP/1.1 0x31 0x2e 0x31 [RFC 9112] ("http/1.1") SPDY/1 0x73 0x70 0x64 0x79 0x2f [http://dev.chromium.org/spdy/spdy-protocol/spdy-protocol-draft1] 0x31 ("spdy/1") SPDY/2 0x73 0x70 0x64 0x79 0x2f [http://dev.chromium.org/spdy/spdy-protocol/spdy-protocol-draft2] 0x32 ("spdy/2") SPDY/3 0x73 0x70 0x64 0x79 0x2f [http://dev.chromium.org/spdy/spdy-protocol/spdy-protocol-draft3] 0x33 ("spdy/3") Traversal 0x73 0x74 0x75 0x6E 0x2E Using Relays 0x74 0x75 0x72 0x6E [RFC 7443] around NAT ("stun.turn") (TURN) NAT discovery 0x73 0x74 0x75 0x6E 0x2E using Session 0x6e 0x61 0x74 0x2d 0x64 Traversal 0x69 0x73 0x63 0x6f 0x76 [RFC 7443] Utilities for 0x65 0x72 0x79 NAT (STUN) ("stun.nat-discovery") HTTP/2 over 0x68 0x32 ("h2") [RFC 9113] TLS This entry reserves an identifier for use within a HTTP/2 over 0x68 0x32 0x63 ("h2c") [RFC 9113] cleartext version of a TCP protocol and is not allowed to appear in a TLS ALPN negotiation. WebRTC Media 0x77 0x65 0x62 0x72 0x74 [RFC 8833] and Data 0x63 ("webrtc") Confidential 0x63 0x2d 0x77 0x65 0x62 WebRTC Media 0x72 0x74 0x63 [RFC 8833] and Data ("c-webrtc") FTP 0x66 0x74 0x70 ("ftp") [RFC 959][RFC 4217] IMAP 0x69 0x6d 0x61 0x70 [RFC 2595] ("imap") POP3 0x70 0x6f 0x70 0x33 [RFC 2595] ("pop3") 0x6d 0x61 0x6e 0x61 0x67 ManageSieve 0x65 0x73 0x69 0x65 0x76 [RFC 5804] 0x65 ("managesieve") CoAP (over 0x63 0x6f 0x61 0x70 [RFC 8323] TLS) ("coap") CoAP (over 0x63 0x6f ("co") [RFC 7252][RFC 9952] DTLS) XMPP 0x78 0x6d 0x70 0x70 0x2d jabber:client 0x63 0x6c 0x69 0x65 0x6e [https://xmpp.org/extensions/xep-0368.html] namespace 0x74 ("xmpp-client") XMPP 0x78 0x6d 0x70 0x70 0x2d jabber:server 0x73 0x65 0x72 0x76 0x65 [https://xmpp.org/extensions/xep-0368.html] namespace 0x72 ("xmpp-server") 0x61 0x63 0x6d 0x65 0x2d acme-tls/1 0x74 0x6c 0x73 0x2f 0x31 [RFC 8737] ("acme-tls/1") OASIS Message Queuing 0x6d 0x71 0x74 0x74 Telemetry ("mqtt") [http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html] Transport (MQTT) DNS-over-TLS 0x64 0x6F 0x74 ("dot") [RFC 7858] Network Time Security Key 0x6E 0x74 0x73 0x6B 0x65 [RFC8915, Section 4] Establishment, 0x2F 0x31 ("ntske/1") version 1 SunRPC 0x73 0x75 0x6e 0x72 0x70 [RFC 9289] 0x63 ("sunrpc") HTTP/3 0x68 0x33 ("h3") [RFC 9114] SMB2 0x73 0x6D 0x62 ("smb") [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5606ad47-5ee0-437a-817e-70c366052962] IRC 0x69 0x72 0x63 ("irc") [RFC 1459] NNTP (reading) 0x6E 0x6E 0x74 0x70 [RFC 3977] ("nntp") NNTP (transit) 0x6E 0x6E 0x73 0x70 [RFC 3977] ("nnsp") DoQ 0x64 0x6F 0x71 ("doq") [RFC 9250] SIP 0x73 0x69 0x70 0x2f 0x32 [RFC 3261] ("sip/2") TDS/8.0 0x74 0x64 0x73 0x2f 0x38 [[MS-TDS]: Tabular Data Stream Protocol] 0x2e 0x30 ("tds/8.0") DICOM 0x64 0x69 0x63 0x6f 0x6d [https://www.dicomstandard.org/current] ("dicom") 0x70 0x6F 0x73 0x74 0x67 PostgreSQL 0x72 0x65 0x73 0x71 0x6C [https://www.postgresql.org/docs/current/protocol.html] ("postgresql") 0x72 0x61 0x64 0x69 0x75 RADIUS/1.0 0x73 0x2f 0x31 0x2e 0x30 [RFC 9765] ("radius/1.0") 0x72 0x61 0x64 0x69 0x75 RADIUS/1.1 0x73 0x2f 0x31 0x2e 0x31 [RFC 9765] ("radius/1.1") NetPerfMeter 0x6e 0x65 0x74 0x70 0x65 Protocol 0x72 0x66 0x6d 0x65 0x74 Control 0x65 0x72 0x2f 0x63 0x6f [https://www.nntb.no/~dreibh/netperfmeter/] Channel 0x6e 0x74 0x72 0x6f 0x6c (NPMP-CONTROL) ("netperfmeter/control") NetPerfMeter 0x6e 0x65 0x74 0x70 0x65 Protocol Data 0x72 0x66 0x6d 0x65 0x74 Channel 0x65 0x72 0x2f 0x64 0x61 [https://www.nntb.no/~dreibh/netperfmeter/] (NPMP-DATA) 0x74 0x61 ("netperfmeter/data") N-PAMP (Native Post-Quantum Deprecated; superseded by Agent 0x6E 0x2D 0x70 0x61 0x6D "n-pamp/3". See Messaging 0x70 0x2F 0x32 [draft-bubblefish-npamp-00] [draft-bubblefish-npamp-02, Protocol), ("n-pamp/2") Section 10.1]. wire major version 2 EoQ 0x45 0x6F 0x51 ("EoQ") [RFC-ietf-regext-epp-quic-12] SNIF over QUIC 0x73 0x6E 0x69 0x66 0x71 [draft-zubov-snif-05, Section 4.4] 0x2F 0x31 ("snifq/1") Negotiates N-PAMP crypto 0x6E 0x2D 0x70 0x61 0x6D generation 3 over QUIC [RFC N-PAMP, crypto 0x70 0x2F 0x33 [draft-bubblefish-npamp-02] 9001] and over TCP with TLS generation 3 ("n-pamp/3") 1.3 [RFC 8446]; see the IANA Considerations section of the reference. TLS CachedInformationType Values Expert(s) Yoav Nir, Rich Salz, Nick Sullivan Reference [RFC 7924][RFC 9851][RFC 9847] Note Requests for registration in the "Specification Required" [RFC 8126] range should be sent to iana@iana.org or submitted via IANA's [application form], per [RFC 9847]. IANA will forward the request to the expert mailing list described in [RFC 8447, Section 17] and track its progress. See the registration procedure table below for more information. Note Any TLS entry added after the IESG approves publication of [RFC 9851] is intended for TLS 1.3 or later, and makes no similar requirement on DTLS. Such entries should have an informal indication like "For TLS 1.3 or later" in that entry, such as the "Comment" column. Available Formats [IMG] CSV Range Registration Procedures 0-63 Standards Action 64-223 Specification Required Value Description Reference Comment 0 Reserved [RFC 7924] 1 cert [RFC 7924] 2 cert_req [RFC 7924] 3-223 Unassigned 224-255 Reserved for Private Use [RFC 7924] TLS Certificate Compression Algorithm IDs Expert(s) Yoav Nir, Rich Salz, Nick Sullivan Reference [RFC 8879][RFC 9851][RFC 9847] Note Requests for registration in the "Specification Required" [RFC 8126] range should be sent to iana@iana.org or submitted via IANA's [application form], per [RFC 9847]. IANA will forward the request to the expert mailing list described in [RFC 8447, Section 17] and track its progress. See the registration procedure table below for more information. Note Any TLS entry added after the IESG approves publication of [RFC 9851] is intended for TLS 1.3 or later, and makes no similar requirement on DTLS. Such entries should have an informal indication like "For TLS 1.3 or later" in that entry, such as the "Comment" column. Available Formats [IMG] CSV Range Registration Procedures 1-255 IETF Review 256-16383 Specification Required 16384-65535 Experimental Use Algorithm Number Description Reference Comment 0 Reserved [RFC 8879] 1 zlib [RFC 8879] 2 brotli [RFC 8879] 3 zstd [RFC 8879] 4-16383 Unassigned 16384-65535 Reserved for Experimental Use [RFC 8879] Licensing Terms