# TLS 1.3 in messaging — what changed and why it matters for SMPP

> TLS 1.3 (RFC 8446, 2018) replaced TLS 1.2 with a faster handshake, removed every algorithm that had been broken in the previous decade, and made forward secrecy mandatory. For messaging, the practical impact is on SMPP bindings: shorter handshake means faster reconnect when an SMSC reboots, and removal of RSA key exchange means a captured pcap of past SMPP traffic cannot be decrypted later even if the private key leaks.

- Canonical URL: https://www.broadnet.me/answers/tls-1-3-in-messaging
- Language: en
- Last reviewed: 2026-09-24
- Publisher: BroadNet (https://www.broadnet.me)

## What was removed

TLS 1.3 drops RSA key exchange, static DH, CBC-mode ciphers, MD5 and SHA-1 in the handshake, compression (the CRIME class of attacks), and renegotiation. What remains: ECDHE for forward secrecy, AES-GCM / ChaCha20-Poly1305 for AEAD, and SHA-256/384 for transcript hashing. The cipher suite list went from dozens to five. This is a feature.

## What changed in the handshake

TLS 1.3 does a single round-trip for the full handshake (down from two), and supports 0-RTT resumption for repeat connections. On an SMPP transceiver bind that reconnects every few hours, the saved RTT compounds. More importantly, the simpler handshake removed the downgrade-attack surface that plagued TLS 1.2 (POODLE, FREAK, Logjam).

## What SMPP customers should check

Three things. Your client library supports TLS 1.3 (most do as of 2022; check OpenSSL >= 1.1.1, JSSE on JDK 11+, Go 1.12+). The SMSC accepts TLS 1.3. The cipher list on your side includes at least one of `TLS_AES_128_GCM_SHA256` or `TLS_CHACHA20_POLY1305_SHA256`.

## Where TLS 1.2 still lingers

Some legacy SMSC stacks (Acision running on RHEL 5, certain Huawei nodes) cap at TLS 1.2 because the underlying OpenSSL is end-of-life. We negotiate down where required, but for any new bind we require TLS 1.3. For PDPL audit purposes, all production SMPP at BroadNet is on TLS 1.3 with cipher pinning.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [SMPP 3.4 vs SMPP 5.0 — what changed and what to use](https://www.broadnet.me/answers/smpp-3-4-vs-5-0)
- [HMAC-SHA256 for DLR webhook signing — how and why](https://www.broadnet.me/answers/hmac-sha256-dlr-signing)
- [SMPP integration](https://www.broadnet.me/developers/smpp)
- [Trust & security](https://www.broadnet.me/trust)