The UK National Cyber Security Centre (NCSC) published updated guidance on October 15, 2026, detailing secure Transport Layer Security (TLS) configurations and the transition to post-quantum cryptography.
Prioritizing TLS 1.3 and Post-Quantum Cryptography
The NCSC stated that its guidance is aimed at system administrators responsible for configuring servers or clients within their estate. According to the publication, only TLS 1.3 provides protection against quantum attacks when configured correctly.
To support the transition, the IETF standardized three post-quantum and traditional hybrid key agreement mechanisms in TLS 1.3 under RFC 10024. These include SecP256r1MLKEM768, SepP384r1MLKEM1024, and X25519MLKEM768, which the NCSC considers suitable for personal, enterprise, and OFFICIAL-tier government information.
Retiring Deprecated Protocols and TLS 1.2
The NCSC emphasized that the Secure Sockets Layer (SSL) protocol and all its versions are deprecated and insecure. Furthermore, TLS 1.0 and TLS 1.1 have been deprecated by the IETF under RFC 8996 and must be disabled.
While TLS 1.2 still provides strong protection against classical attacks when using recommended cryptographic profiles, the NCSC advises organizations using TLS 1.2 to develop a migration plan to TLS 1.3 in order to adopt post-quantum cryptography.
Web and Mail Server Security Recommendations
For web services, the NCSC recommended serving sites exclusively via HTTPS, redirecting unencrypted HTTP requests, and utilizing HTTP Strict Transport Security (HSTS) with preloading. Administrators should also mark cookies as secure and use the upgrade-insecure-requests directive.
For mail servers, the NCSC advised using Implicit TLS rather than STARTTLS for communications between end users and mail services, as outlined in RFC 8314. Additionally, administrators should consider deploying Mail Transfer Agent Strict Transport Security (MTA-STS) and SMTP TLS Reporting (TLS-RPT).
What to do
- Enable TLS 1.3 and prefer it over TLS 1.2 where possible.
- Disable TLS 1.1, TLS 1.0, and all versions of SSL.
- Enable at least one recommended post-quantum key agreement algorithm as soon as implementation supports them.
- Serve websites and services only using HTTPS, and use HTTP Strict Transport Security (HSTS) with preloading.
- Use Implicit TLS instead of STARTTLS for communications between end users and mail services.
Key facts and where they come from
- The guidance targets system administrators configuring servers or clients.
This guidance is aimed at system administrators who are responsible for configuring servers or clients within their estate.
- Only TLS 1.3 offers protection against quantum attacks when properly configured.
Only TLS 1.3 provides protection against quantum attacks when configured correctly.
- Administrators must disable TLS 1.1, TLS 1.0, and all versions of SSL.
Disable TLS 1.1 and TLS 1.0. You must disable all versions of SSL.
- RFC 10024 standardizes three post-quantum and traditional hybrid key agreement mechanisms in TLS 1.3.
RFC 10024 standardises three post-quantum/traditional hybrid key agreement mechanisms in TLS 1.3.
