TLS 1.3 and HTTP/3: what's different at the edge

Every Benediction zone serves TLS 1.3 by default, and Pro and Enterprise zones serve HTTP/3 as well. Neither was a hard sell internally — the security and latency arguments are clear. What's worth writing down is how much each one changed things for real users.

TLS 1.3: fewer round trips, stronger crypto

The headline changes in TLS 1.3 are a shorter handshake and a smaller, safer cipher suite. A full handshake takes one round trip instead of two, and resumed connections take zero. On a mobile connection at 150ms RTT, that's a quarter-second of user-perceived latency gone before the page even starts loading.

It also removed the weak knobs. Static RSA key exchange, renegotiation, and the broken CBC suites are gone. That's why we disable TLS 1.0 and 1.1 on every zone — the compatibility cost is negligible and the exposure is real.

HTTP/3 and QUIC: designed for lossy networks

HTTP/3 runs over QUIC, which replaces TCP at the transport layer. The practical differences show up exactly where the internet is worst:

• No head-of-line blocking. A dropped packet pauses the affected stream, not the whole connection.
• Faster handshake. Connection setup is folded into the TLS handshake — one RTT to first byte.
• Graceful network transitions. QUIC connections survive IP changes, so switching from Wi-Fi to mobile doesn't reset everything.

On our telemetry, enabling HTTP/3 cut median TTFB by 11% on mobile networks and reduced time-to-interactive variance substantially. The gains were biggest in regions with packet loss — which is to say, exactly where your users are.

How the stack fits together

Client ──► TLS 1.3 (always on)
             └─► HTTP/3 over QUIC/UDP   (Pro+, auto-negotiated)
             └─► HTTP/2 over TLS/TCP    (fallback for old clients)
             └─► HTTP/1.1               (final fallback, legacy)

Clients that support HTTP/3 use it; everything else falls back automatically. There is no configuration to maintain — we negotiate per connection, and the origin side never changes because edge-to-origin is a separate, always-TLS connection.

What we watch for

Two things keep us honest here. First, we track the HTTP/3 adoption curve per zone — it's a good signal for client population health. Second, we monitor TLS handshake failures by protocol version, so any client breaking on the new stack shows up immediately rather than silently.

If you're on Pro and want HTTP/3 confirmed on your zone, or want to understand a specific handshake, our status page and analytics API have you covered.