19 files changed, 97 insertions, 99 deletions

diff --git a/src/lib/libcrypto/rsa/rsa_ameth.c b/src/lib/libcrypto/rsa/rsa_ameth.c
index aca00a9ec8..9d8e2d2789 100644
--- a/src/lib/libcrypto/rsa/rsa_ameth.c
+++ b/src/lib/libcrypto/rsa/rsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_ameth.c,v 1.65 2026/04/07 13:16:41 tb Exp $ */
+/* $OpenBSD: rsa_ameth.c,v 1.66 2026/08/21 17:15:22 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -879,7 +879,7 @@ rsa_pss_signature_info(const X509_ALGOR *alg, int *out_md_nid,
                 goto err;
 
         /*
-         * RFC 8446, section 4.2.3 - restricts the digest algorithm:
+         * RFC 9846, section 4.3.3 - restricts the digest algorithm:
          * - it must be one of SHA256, SHA384, and SHA512;
          * - the same digest must be used in the mask generation function;
          * - the salt length must match the output length of the digest.
diff --git a/src/lib/libssl/man/SSL_get_finished.3 b/src/lib/libssl/man/SSL_get_finished.3
index 74e398563e..bf3913f7f0 100644
--- a/src/lib/libssl/man/SSL_get_finished.3
+++ b/src/lib/libssl/man/SSL_get_finished.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_get_finished.3,v 1.4 2026/08/21 17:05:01 tb Exp $
+.\" $OpenBSD: SSL_get_finished.3,v 1.5 2026/08/21 17:15:22 tb Exp $
 .\"
 .\" Copyright (c) 2020 Theo Buehler <tb@openbsd.org>
 .\"
@@ -62,8 +62,8 @@ finished message.
 .Xr SSL_get_session 3 ,
 .Xr SSL_set_session 3
 .Sh STANDARDS
-RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3,
-section 4.4.4: Finished.
+RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3,
+section 4.5.3: Finished.
 .Pp
 RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2,
 section 7.4.9: Finished.
diff --git a/src/lib/libssl/man/SSL_read_early_data.3 b/src/lib/libssl/man/SSL_read_early_data.3
index d36b1e49f7..5ad0dc1d9d 100644
--- a/src/lib/libssl/man/SSL_read_early_data.3
+++ b/src/lib/libssl/man/SSL_read_early_data.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: SSL_read_early_data.3,v 1.5 2025/06/08 22:52:00 schwarze Exp $
+.\" $OpenBSD: SSL_read_early_data.3,v 1.6 2026/08/21 17:15:22 tb Exp $
 .\" content checked up to: OpenSSL 6328d367 Jul 4 21:58:30 2020 +0200
 .\"
 .\" Copyright (c) 2020 Ingo Schwarze <schwarze@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 8 2025 $
+.Dd $Mdocdate: August 21 2026 $
 .Dt SSL_READ_EARLY_DATA 3
 .Os
 .Sh NAME
@@ -158,15 +158,15 @@ or
 .Xr SSL_read 3 ,
 .Xr SSL_write 3
 .Sh STANDARDS
-RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3:
-.Bl -tag -width "section 4.2.10" -compact
+RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3:
+.Bl -tag -width "section 4.3.10" -compact
 .It Section 2.3
 0-RTT data
-.It Section 4.2.10
+.It Section 4.3.10
 Early Data Indication
 .It Section 8
 0-RTT and Anti-Replay
-.It Appendix E.5
+.It Appendix F.5
 Replay Attacks on 0-RTT
 .El
 .Sh HISTORY
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 929de03a3d..9a5e8cd2cc 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.261 2026/07/31 03:59:50 kenjiro Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.262 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -722,7 +722,7 @@ const SSL_CIPHER ssl3_ciphers[] = {
 
 #ifdef LIBRESSL_HAS_TLS1_3
         /*
-         * TLSv1.3 cipher suites (RFC 8446).
+         * TLSv1.3 cipher suites (RFC 9846).
          */
         {
                 .value = 0x1301,
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index 4803e35dd2..69221332f5 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.175 2026/07/15 15:00:17 jsing Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.176 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -893,7 +893,7 @@ ssl3_get_server_hello(SSL *s)
         if (s->s3->hs.our_max_tls_version >= TLS1_2_VERSION &&
             s->s3->hs.negotiated_tls_version < s->s3->hs.our_max_tls_version) {
                 /*
-                 * RFC 8446 section 4.1.3. We must not downgrade if the server
+                 * RFC 9846 section 4.2.3. We must not downgrade if the server
                  * random value contains the TLS 1.2 or TLS 1.1 magical value.
                  */
                 if (!CBS_skip(&server_random,
diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h
index 9999d55963..67ca4a5511 100644
--- a/src/lib/libssl/ssl_local.h
+++ b/src/lib/libssl/ssl_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.42 2026/06/08 11:38:04 tb Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.43 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -428,7 +428,7 @@ struct ssl_session_st {
 
         char *tlsext_hostname;
 
-        /* Session resumption - RFC 5077 and RFC 8446. */
+        /* Session resumption - RFC 5077 and RFC 9846. */
         unsigned char *tlsext_tick;             /* Session ticket */
         size_t tlsext_ticklen;                  /* Session ticket length */
         uint32_t tlsext_tick_lifetime_hint;     /* Session lifetime hint in seconds */
diff --git a/src/lib/libssl/ssl_sigalgs.h b/src/lib/libssl/ssl_sigalgs.h
index 775842a093..e435ccc287 100644
--- a/src/lib/libssl/ssl_sigalgs.h
+++ b/src/lib/libssl/ssl_sigalgs.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.h,v 1.28 2026/05/31 14:34:44 jsing Exp $ */
+/* $OpenBSD: ssl_sigalgs.h,v 1.29 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018-2019 Bob Beck <beck@openbsd.org>
  *
@@ -23,8 +23,8 @@ __BEGIN_HIDDEN_DECLS
 #define SIGALG_NONE                     0x0000
 
 /*
- * RFC 8446 Section 4.2.3
- * RFC 5246 Section 7.4.1.4.1
+ * RFC 9846 section 4.3.3
+ * RFC 5246 section 7.4.1.4.1
  */
 #define SIGALG_RSA_PKCS1_SHA224         0x0301
 #define SIGALG_RSA_PKCS1_SHA256         0x0401
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index 73bdeacce0..43260d8065 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.170 2026/06/06 15:24:26 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.171 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1027,7 +1027,7 @@ ssl3_get_client_hello(SSL *s)
         if (s->s3->hs.our_max_tls_version >= TLS1_2_VERSION &&
             s->s3->hs.negotiated_tls_version < s->s3->hs.our_max_tls_version) {
                 /*
-                 * RFC 8446 section 4.1.3. If we are downgrading from TLS 1.3
+                 * RFC 9846 section 4.2.3. If we are downgrading from TLS 1.3
                  * we must set the last 8 bytes of the server random to magical
                  * values to indicate we meant to downgrade.  For TLS 1.2 it is
                  * recommended that we do the same.
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 039218e1ef..35e554e292 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.165 2026/08/18 04:40:17 tb Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.166 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -281,10 +281,8 @@ tlsext_supportedgroups_server_process(SSL *s, uint16_t msg_type, CBS *cbs,
                 if (!CBS_get_u16(&grouplist, &groups[i]))
                         goto err;
                 /*
-                 * Do not allow duplicate groups to be sent. This is not
-                 * currently specified in RFC 8446 or earlier, but there is no
-                 * legitimate justification for this to occur in TLS 1.2 or TLS
-                 * 1.3.
+                 * RFC 9846 section 4.3.7: The "named_group_list" MUST NOT
+                 * contain any duplicate entries.
                  */
                 for (j = 0; j < i; j++) {
                         if (groups[i] == groups[j]) {
@@ -336,7 +334,7 @@ tlsext_supportedgroups_client_process(SSL *s, uint16_t msg_type, CBS *cbs,
                 return 0;
 
         /*
-         * RFC 8446, section 4.2.7: TLSv1.3 servers can send this extension but
+         * RFC 9846 section 4.3.7: TLSv1.3 servers can send this extension but
          * clients must not act on it during the handshake. This allows servers
          * to advertise their preferences for subsequent handshakes. We ignore
          * this complication.
@@ -1064,7 +1062,7 @@ tlsext_ocsp_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         if (ssl_effective_tls_version(s) >= TLS1_3_VERSION) {
                 if (msg_type == SSL_TLSEXT_MSG_CR) {
                         /*
-                         * RFC 8446, 4.4.2.1 - the server may request an OCSP
+                         * RFC 9846, 4.5.1.1 - the server may request an OCSP
                          * response with an empty status_request.
                          */
                         if (CBS_len(cbs) == 0)
@@ -1440,7 +1438,7 @@ tlsext_srtp_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 #endif /* OPENSSL_NO_SRTP */
 
 /*
- * TLSv1.3 Key Share - RFC 8446 section 4.2.8.
+ * TLSv1.3 Key Share - RFC 9846 section 4.3.8.
  */
 static int
 tlsext_keyshare_client_needs(SSL *s, uint16_t msg_type)
@@ -1508,7 +1506,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         CBS client_shares, key_exchange;
 
         /*
-         * RFC 8446 section 4.2.8:
+         * RFC 9846 section 4.3.8:
          *
          * Each KeyShareEntry value MUST correspond to a group offered in the
          * "supported_groups" extension and MUST appear in the same order.
@@ -1597,7 +1595,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
                 /*
                  * There are no supported groups that are shared between the
                  * client and server - this is treated as a handshake failure
-                 * or as insufficient security - see RFC 8446 section 4.1.1.
+                 * or as insufficient security - see RFC 9846 section 4.2.1.
                  */
                 *alert = TLS13_ALERT_HANDSHAKE_FAILURE;
                 return 0;
@@ -1766,7 +1764,7 @@ tlsext_keyshare_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 }
 
 /*
- * Supported Versions - RFC 8446 section 4.2.1.
+ * Supported Versions - RFC 9846 section 4.3.1.
  */
 static int
 tlsext_versions_client_needs(SSL *s, uint16_t msg_type)
@@ -1868,7 +1866,7 @@ tlsext_versions_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 
 
 /*
- * Cookie - RFC 8446 section 4.2.2.
+ * Cookie - RFC 9846 section 4.3.2.
  */
 
 static int
@@ -1980,7 +1978,7 @@ tlsext_cookie_client_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
 }
 
 /*
- * Pre-Shared Key Exchange Modes - RFC 8446, 4.2.9.
+ * Pre-Shared Key Exchange Modes - RFC 9846 section 4.3.9.
  */
 
 static int
@@ -2050,7 +2048,7 @@ tlsext_psk_kex_modes_client_process(SSL *s, uint16_t msg_type, CBS *cbs,
 }
 
 /*
- * Pre-Shared Key Extension - RFC 8446, 4.2.11
+ * Pre-Shared Key Extension - RFC 9846 section 4.3.11
  */
 
 static int
@@ -2484,7 +2482,7 @@ tlsext_randomize_build_order(SSL *s)
                 return 0;
         s->tlsext_build_order_len = N_TLS_EXTENSIONS;
 
-        /* RFC 8446, section 4.2 - PSK MUST be the last extension in the CH. */
+        /* RFC 9846 section 4.3 - PSK MUST be the last extension in the CH. */
         if ((psk_ext = tls_extension_find(TLSEXT_TYPE_pre_shared_key,
             NULL)) == NULL)
                 return 0;
@@ -2538,7 +2536,7 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb)
                 tlsext = s->tlsext_build_order[i];
                 ext = tlsext_funcs(tlsext, is_server);
 
-                /* RFC 8446 Section 4.2 */
+                /* RFC 9846 section 4.3 */
                 if (tls_version >= TLS1_3_VERSION &&
                     !(tlsext->messages & msg_type))
                         continue;
@@ -2571,7 +2569,7 @@ static int
 tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs)
 {
         /*
-         * RFC 8446 4.1.2. For subsequent CH, early data will be removed,
+         * RFC 9846, 4.2.2. For subsequent CH, early data will be removed,
          * cookie may be added, padding may be removed.
          */
         struct tls13_ctx *ctx = s->tls13;
@@ -2644,7 +2642,7 @@ tlsext_parse(SSL *s, struct tlsext_data *td, int is_server, uint16_t msg_type,
                                 goto err;
                 }
 
-                /* RFC 8446 Section 4.2 */
+                /* RFC 9846 section 4.3 */
                 if (tls_version >= TLS1_3_VERSION &&
                     !(tlsext->messages & msg_type)) {
                         alert_desc = SSL_AD_ILLEGAL_PARAMETER;
diff --git a/src/lib/libssl/ssl_tlsext.h b/src/lib/libssl/ssl_tlsext.h
index 4fd2ec05a0..e1fc2634c2 100644
--- a/src/lib/libssl/ssl_tlsext.h
+++ b/src/lib/libssl/ssl_tlsext.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.h,v 1.34 2024/03/26 03:44:11 beck Exp $ */
+/* $OpenBSD: ssl_tlsext.h,v 1.35 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -20,7 +20,7 @@
 #ifndef HEADER_SSL_TLSEXT_H
 #define HEADER_SSL_TLSEXT_H
 
-/* TLSv1.3 - RFC 8446 Section 4.2. */
+/* TLSv1.3 - RFC 9846 section 4.3. */
 #define SSL_TLSEXT_MSG_CH       0x0001  /* ClientHello */
 #define SSL_TLSEXT_MSG_SH       0x0002  /* ServerHello */
 #define SSL_TLSEXT_MSG_EE       0x0004  /* EncryptedExtension */
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
index 2d5dffc6cf..42451a4214 100644
--- a/src/lib/libssl/tls1.h
+++ b/src/lib/libssl/tls1.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls1.h,v 1.61 2025/04/18 07:34:01 tb Exp $ */
+/* $OpenBSD: tls1.h,v 1.62 2026/08/21 17:15:22 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -240,7 +240,7 @@ extern "C" {
 /* ExtensionType value from RFC 5054. */
 #define TLSEXT_TYPE_srp                         12
 
-/* ExtensionType value from RFC 5246/RFC 8446. */
+/* ExtensionType value from RFC 5246/RFC 9846. */
 #define TLSEXT_TYPE_signature_algorithms        13
 
 /* ExtensionType value from RFC 5764. */
@@ -258,7 +258,7 @@ extern "C" {
 /* ExtensionType value from RFC 4507. */
 #define TLSEXT_TYPE_session_ticket              35
 
-/* ExtensionType values from RFC 8446 section 4.2 */
+/* ExtensionType values from RFC 9846 section 4.3 */
 #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
 #define TLSEXT_TYPE_pre_shared_key              41
 #define TLSEXT_TYPE_early_data                  42
@@ -279,7 +279,7 @@ extern "C" {
 
 /*
  * TLS 1.3 extension names from OpenSSL, where they decided to use a different
- * name from that given in RFC 8446.
+ * name from that given in RFC 9846.
  */
 #if defined(LIBRESSL_HAS_TLS1_3)
 #define TLSEXT_TYPE_psk                         TLSEXT_TYPE_pre_shared_key
@@ -486,7 +486,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 #define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256    0x030000C4
 #define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256        0x030000C5
 
-/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */
+/* TLS 1.3 cipher suites from RFC 9846 appendix B.4. */
 #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
 #define TLS1_3_CK_AES_128_GCM_SHA256                    0x03001301
 #define TLS1_3_CK_AES_256_GCM_SHA384                    0x03001302
@@ -725,7 +725,7 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 #define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305     "ECDHE-ECDSA-CHACHA20-POLY1305"
 #define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305         "DHE-RSA-CHACHA20-POLY1305"
 
-/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */
+/* TLS 1.3 cipher suites from RFC 9846 appendix B.4. */
 #if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL)
 #define TLS1_3_TXT_AES_128_GCM_SHA256                   "AEAD-AES128-GCM-SHA256"
 #define TLS1_3_TXT_AES_256_GCM_SHA384                   "AEAD-AES256-GCM-SHA384"
diff --git a/src/lib/libssl/tls13_client.c b/src/lib/libssl/tls13_client.c
index fec3e825fe..8abfdbdd1f 100644
--- a/src/lib/libssl/tls13_client.c
+++ b/src/lib/libssl/tls13_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_client.c,v 1.108 2026/06/14 15:51:17 jsing Exp $ */
+/* $OpenBSD: tls13_client.c,v 1.109 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -73,8 +73,8 @@ tls13_client_init(struct tls13_ctx *ctx)
         /*
          * The legacy session identifier should either be set to an
          * unpredictable 32-byte value or zero length... a non-zero length
-         * legacy session identifier triggers compatibility mode (see RFC 8446
-         * Appendix D.4). In the pre-TLSv1.3 case a zero length value is used.
+         * legacy session identifier triggers compatibility mode (see RFC 9846
+         * Appendix E.4). In the pre-TLSv1.3 case a zero length value is used.
          */
         if (ctx->middlebox_compat &&
             ctx->hs->our_max_tls_version >= TLS1_3_VERSION) {
@@ -242,7 +242,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         if (tls13_server_hello_is_legacy(cbs)) {
                 if (ctx->hs->our_max_tls_version >= TLS1_3_VERSION) {
                         /*
-                         * RFC 8446 section 4.1.3: we must not downgrade if
+                         * RFC 9846 section 4.2.3: we must not downgrade if
                          * the server random value contains the TLS 1.2 or 1.1
                          * magical value.
                          */
@@ -285,7 +285,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         /*
          * The supported versions extension indicated 0x0304 or greater.
          * Ensure that it was 0x0304 and that legacy version is set to 0x0303
-         * (RFC 8446 section 4.2.1).
+         * (RFC 9846 section 4.3.1).
          */
         if (ctx->hs->tls13.server_version != TLS1_3_VERSION ||
             legacy_version != TLS1_2_VERSION) {
@@ -318,7 +318,7 @@ tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         if (!(ctx->handshake_stage.hs_type & WITHOUT_HRR) && !ctx->hs->tls13.hrr) {
                 /*
                  * A ServerHello following a HelloRetryRequest MUST use the same
-                 * cipher suite (RFC 8446 section 4.1.4).
+                 * cipher suite (RFC 9846 section 4.2.4).
                  */
                 if (ctx->hs->cipher != cipher) {
                         ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER;
@@ -450,7 +450,7 @@ tls13_client_hello_retry_send(struct tls13_ctx *ctx, CBB *cbb)
         /*
          * Ensure that the server supported group is one that we listed in our
          * supported groups and is not the same as the key share we previously
-         * offered. See RFC 8446 section 4.2.8.
+         * offered. See RFC 9846 section 4.3.8.
          */
         if (!tls1_check_group(ctx->ssl, ctx->hs->tls13.server_group)) {
                 ctx->alert = TLS13_ALERT_ILLEGAL_PARAMETER;
@@ -855,8 +855,8 @@ tls13_client_select_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY **out_cpk,
         *out_sigalg = NULL;
 
         /*
-         * XXX - RFC 8446, 4.4.2.3: the server can communicate preferences
-         * with the certificate_authorities (4.2.4) and oid_filters (4.2.5)
+         * XXX - RFC 9846, 4.5.1.2: the server can communicate preferences
+         * with the certificate_authorities (4.3.4) and oid_filters (4.3.5)
          * extensions. We should honor the former and must apply the latter.
          */
 
diff --git a/src/lib/libssl/tls13_handshake.c b/src/lib/libssl/tls13_handshake.c
index 0dc2333708..24178a3396 100644
--- a/src/lib/libssl/tls13_handshake.c
+++ b/src/lib/libssl/tls13_handshake.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_handshake.c,v 1.73 2024/02/03 19:57:14 tb Exp $ */
+/*      $OpenBSD: tls13_handshake.c,v 1.74 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018-2021 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
@@ -22,7 +22,7 @@
 #include "tls13_handshake.h"
 #include "tls13_internal.h"
 
-/* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
+/* Based on RFC 9846 and inspired by s2n's TLS 1.2 state machine. */
 
 struct tls13_handshake_action {
         uint8_t handshake_type;
diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
index 7a7f8abc63..d3d7ddb9b3 100644
--- a/src/lib/libssl/tls13_internal.h
+++ b/src/lib/libssl/tls13_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_internal.h,v 1.105 2025/03/09 15:12:18 tb Exp $ */
+/* $OpenBSD: tls13_internal.h,v 1.106 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -114,7 +114,7 @@ struct tls13_secret {
         size_t len;
 };
 
-/* RFC 8446 Section 7.1  Page 92 */
+/* RFC 9846 section 7.1 */
 struct tls13_secrets {
         const EVP_MD *digest;
         int resumption;
@@ -339,7 +339,7 @@ int tls13_legacy_shutdown(SSL *ssl);
 int tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert);
 
 /*
- * Message Types - RFC 8446, Section B.3.
+ * Message Types - RFC 9846 section B.3.
  *
  * Values listed as "_RESERVED" were used in previous versions of TLS and are
  * listed here for completeness.  TLS 1.3 implementations MUST NOT send them but
diff --git a/src/lib/libssl/tls13_key_schedule.c b/src/lib/libssl/tls13_key_schedule.c
index 05bcf0f006..01fbe6603e 100644
--- a/src/lib/libssl/tls13_key_schedule.c
+++ b/src/lib/libssl/tls13_key_schedule.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_key_schedule.c,v 1.18 2022/11/26 16:08:56 tb Exp $ */
+/* $OpenBSD: tls13_key_schedule.c,v 1.19 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, Bob Beck <beck@openbsd.org>
  *
@@ -47,7 +47,7 @@ tls13_secret_cleanup(struct tls13_secret *secret)
 
 /*
  * Allocate a set of secrets for a key schedule using
- * a size of hash_length from RFC 8446 section 7.1.
+ * a size of hash_length from RFC 9846 section 7.1.
  */
 struct tls13_secrets *
 tls13_secrets_create(const EVP_MD *digest, int resumption)
@@ -256,7 +256,7 @@ tls13_derive_early_secrets(struct tls13_secrets *secrets,
             &secrets->empty_hash))
                 return 0;
 
-        /* RFC 8446 recommends */
+        /* RFC 9846 recommends */
         if (!secrets->insecure)
                 explicit_bzero(secrets->extracted_early.data,
                     secrets->extracted_early.len);
@@ -300,7 +300,7 @@ tls13_derive_handshake_secrets(struct tls13_secrets *secrets,
             &secrets->empty_hash))
                 return 0;
 
-        /* RFC 8446 recommends */
+        /* RFC 9846 recommends */
         if (!secrets->insecure)
                 explicit_bzero(secrets->extracted_handshake.data,
                     secrets->extracted_handshake.len);
@@ -349,7 +349,7 @@ tls13_derive_application_secrets(struct tls13_secrets *secrets,
             context))
                 return 0;
 
-        /* RFC 8446 recommends */
+        /* RFC 9846 recommends */
         if (!secrets->insecure)
                 explicit_bzero(secrets->extracted_master.data,
                     secrets->extracted_master.len);
@@ -400,7 +400,7 @@ tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len,
         int ret = 0;
 
         /*
-         * RFC 8446 Section 7.5.
+         * RFC 9846 section 7.5.
          */
 
         memset(&context, 0, sizeof(context));
diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
index c3470b2931..f93452402f 100644
--- a/src/lib/libssl/tls13_lib.c
+++ b/src/lib/libssl/tls13_lib.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_lib.c,v 1.78 2025/06/07 10:25:12 tb Exp $ */
+/*      $OpenBSD: tls13_lib.c,v 1.79 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
@@ -25,14 +25,14 @@
 #include "tls13_internal.h"
 
 /*
- * RFC 8446, section 4.6.1. Servers must not indicate a lifetime longer than
+ * RFC 9846 section 4.7.1. Servers must not indicate a lifetime longer than
  * 7 days and clients must not cache tickets for longer than 7 days.
  */
 
 #define TLS13_MAX_TICKET_LIFETIME       (7 * 24 * 3600)
 
 /*
- * Downgrade sentinels - RFC 8446 section 4.1.3, magic values which must be set
+ * Downgrade sentinels - RFC 9846 section 4.2.3, magic values which must be set
  * by the server in server random if it is willing to downgrade but supports
  * TLSv1.3
  */
@@ -44,7 +44,7 @@ const uint8_t tls13_downgrade_11[8] = {
 };
 
 /*
- * HelloRetryRequest hash - RFC 8446 section 4.1.3.
+ * HelloRetryRequest hash - RFC 9846 section 4.2.3.
  */
 const uint8_t tls13_hello_retry_request_hash[32] = {
         0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11,
@@ -54,7 +54,7 @@ const uint8_t tls13_hello_retry_request_hash[32] = {
 };
 
 /*
- * Certificate Verify padding - RFC 8446 section 4.4.3.
+ * Certificate Verify padding - RFC 9846 section 4.5.2.
  */
 const uint8_t tls13_cert_verify_pad[64] = {
         0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
@@ -156,7 +156,7 @@ tls13_alert_received_cb(uint8_t alert_level, uint8_t alert_desc, void *arg)
         if (alert_desc == TLS13_ALERT_USER_CANCELED) {
                 /*
                  * We treat this as advisory, since a close_notify alert
-                 * SHOULD follow this alert (RFC 8446 section 6.1).
+                 * MUST follow this alert (RFC 9846 section 6.1).
                  */
                 return;
         }
@@ -369,7 +369,7 @@ tls13_key_update_recv(struct tls13_ctx *ctx, CBS *cbs)
         return tls13_send_alert(ctx->rl, alert);
 }
 
-/* RFC 8446 section 4.6.1 */
+/* RFC 9846 section 4.7.1 */
 static ssize_t
 tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
 {
@@ -628,7 +628,7 @@ tls13_synthetic_handshake_message(struct tls13_ctx *ctx)
 
         /*
          * Replace ClientHello with synthetic handshake message - see
-         * RFC 8446 section 4.4.1.
+         * RFC 9846 section 4.1.
          */
         if (!tls1_transcript_hash_init(s))
                 goto err;
diff --git a/src/lib/libssl/tls13_record.h b/src/lib/libssl/tls13_record.h
index 18e4fa1aba..e9bcae6efd 100644
--- a/src/lib/libssl/tls13_record.h
+++ b/src/lib/libssl/tls13_record.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record.h,v 1.5 2021/10/23 13:12:14 jsing Exp $ */
+/* $OpenBSD: tls13_record.h,v 1.6 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -23,7 +23,7 @@
 __BEGIN_HIDDEN_DECLS
 
 /*
- * TLSv1.3 Record Protocol - RFC 8446 section 5.
+ * TLSv1.3 Record Protocol - RFC 9846 section 5.
  *
  * The maximum plaintext is 2^14, however for inner plaintext an additional
  * byte is allowed for the content type. A maximum AEAD overhead of 255-bytes
@@ -41,7 +41,7 @@ __BEGIN_HIDDEN_DECLS
         (TLS13_RECORD_HEADER_LEN + TLS13_RECORD_MAX_CIPHERTEXT_LEN)
 
 /*
- * TLSv1.3 Per-Record Nonces and Sequence Numbers - RFC 8446 section 5.3.
+ * TLSv1.3 Per-Record Nonces and Sequence Numbers - RFC 9846 section 5.3.
  */
 #define TLS13_RECORD_SEQ_NUM_LEN 8
 
diff --git a/src/lib/libssl/tls13_record_layer.c b/src/lib/libssl/tls13_record_layer.c
index 778356af15..e573b50760 100644
--- a/src/lib/libssl/tls13_record_layer.c
+++ b/src/lib/libssl/tls13_record_layer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record_layer.c,v 1.75 2026/07/31 03:59:50 kenjiro Exp $ */
+/* $OpenBSD: tls13_record_layer.c,v 1.76 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -95,7 +95,7 @@ struct tls13_record_layer {
         uint8_t alert_level;
         uint8_t alert_desc;
 
-        /* Pending post-handshake handshake messages (RFC 8446, section 4.6). */
+        /* Pending post-handshake handshake messages (RFC 9846, section 4.7). */
         CBS phh_cbs;
         uint8_t *phh_data;
         size_t phh_len;
@@ -200,7 +200,7 @@ tls13_record_layer_inc_seq_num(uint8_t *seq_num)
 {
         int i;
 
-        /* RFC 8446 section 5.3 - sequence numbers must not wrap. */
+        /* RFC 9846 section 5.3 - sequence numbers must not wrap. */
         if (memcmp(seq_num, tls13_max_seq_num, TLS13_RECORD_SEQ_NUM_LEN) == 0)
                 return 0;
 
@@ -222,7 +222,7 @@ tls13_record_layer_update_nonce(struct tls13_secret *nonce,
                 return 0;
 
         /*
-         * RFC 8446 section 5.3 - sequence number is zero padded and XOR'd
+         * RFC 9846 section 5.3 - sequence number is zero padded and XOR'd
          * with the IV to produce a per-record nonce. The IV will also be
          * at least 8-bytes in length.
          */
@@ -284,7 +284,7 @@ tls13_record_layer_process_alert(struct tls13_record_layer *rl)
         ssize_t ret = TLS13_IO_FAILURE;
 
         /*
-         * RFC 8446 - sections 5.1 and 6.
+         * RFC 9846 - sections 5.1 and 6.
          *
          * A TLSv1.3 alert record can only contain a single alert - this means
          * that processing the alert must consume all of the record. The alert
@@ -305,8 +305,8 @@ tls13_record_layer_process_alert(struct tls13_record_layer *rl)
         tls_content_clear(rl->rcontent);
 
         /*
-         * Alert level is ignored for closure alerts (RFC 8446 section 6.1),
-         * however for error alerts (RFC 8446 section 6.2), the alert level
+         * Alert level is ignored for closure alerts (RFC 9846 section 6.1),
+         * however for error alerts (RFC 9846 section 6.2), the alert level
          * must be specified as fatal.
          */
         if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) {
@@ -344,7 +344,7 @@ tls13_record_layer_send_alert(struct tls13_record_layer *rl)
 {
         ssize_t ret;
 
-        /* This has to fit into a single record, per RFC 8446 section 5.1. */
+        /* This has to fit into a single record, per RFC 9846 section 5.1. */
         if ((ret = tls13_record_layer_write_record(rl, SSL3_RT_ALERT,
             rl->alert_data, rl->alert_len)) != rl->alert_len) {
                 if (ret == TLS13_IO_EOF)
@@ -604,7 +604,7 @@ tls13_record_layer_open_record_protected(struct tls13_record_layer *rl)
                         break;
         }
         if (content_type == 0) {
-                /* Unexpected message per RFC 8446 section 5.4. */
+                /* Unexpected message per RFC 9846 section 5.4. */
                 rl->alert = TLS13_ALERT_UNEXPECTED_MESSAGE;
                 goto err;
         }
@@ -835,7 +835,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl)
         /*
          * In response to a client hello we may receive an alert in a
          * record with a legacy version. Otherwise enforce that the
-         * legacy record version is 0x0303 per RFC 8446, section 5.1.
+         * legacy record version is 0x0303 per RFC 9846, section 5.1.
          */
         if (rl->legacy_version == TLS1_2_VERSION &&
             tls13_record_version(rl->rrec) != TLS1_2_VERSION &&
@@ -846,7 +846,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl)
          * Bag of hacks ahead... after the first ClientHello message has been
          * sent or received and before the peer's Finished message has been
          * received, we may receive an unencrypted ChangeCipherSpec record
-         * (see RFC 8446 section 5 and appendix D.4). This record must be
+         * (see RFC 9846 section 5 and appendix E.4). This record must be
          * ignored.
          */
         if (content_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
@@ -881,7 +881,7 @@ tls13_record_layer_read_record(struct tls13_record_layer *rl)
         /*
          * On receiving a handshake or alert record with empty inner plaintext,
          * we must terminate the connection with an unexpected_message alert.
-         * See RFC 8446 section 5.4.
+         * See RFC 9846 section 5.4.
          */
         if (tls_content_remaining(rl->rcontent) == 0 &&
             (tls_content_type(rl->rcontent) == SSL3_RT_ALERT ||
diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c
index 8ad11c6428..8b0dc8a26b 100644
--- a/src/lib/libssl/tls13_server.c
+++ b/src/lib/libssl/tls13_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_server.c,v 1.113 2026/07/31 03:59:50 kenjiro Exp $ */
+/* $OpenBSD: tls13_server.c,v 1.114 2026/08/21 17:15:22 tb Exp $ */
 /*
  * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -102,13 +102,13 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx)
         SSL *s = ctx->ssl;
 
         /*
-         * RFC 8446, section 9.2. If the ClientHello has supported_versions
+         * RFC 9846 section 9.2. If the ClientHello has supported_versions
          * containing TLSv1.3, presence or absence of some extensions requires
          * presence or absence of others.
          */
 
         /*
-         * RFC 8446 section 4.2.9 - if we received a pre_shared_key, then we
+         * RFC 9846 section 4.3.9 - if we received a pre_shared_key, then we
          * also need psk_key_exchange_modes. Otherwise, section 9.2 specifies
          * that we need both signature_algorithms and supported_groups.
          */
@@ -133,7 +133,7 @@ tls13_client_hello_required_extensions(struct tls13_ctx *ctx)
 
         /*
          * XXX - Require server_name from client? If so, we SHOULD enforce
-         * this here - RFC 8446, 9.2.
+         * this here - RFC 9846, 9.2.
          */
 
         return 1;
@@ -246,7 +246,7 @@ tls13_client_hello_process(struct tls13_ctx *ctx, CBS *cbs)
         /*
          * The legacy session identifier must either be zero length or a 32 byte
          * value (in which case the client is requesting middlebox compatibility
-         * mode), as per RFC 8446 section 4.1.2. If it is valid, store the value
+         * mode), as per RFC 9846 section 4.2.2. If it is valid, store the value
          * so that we can echo it back to the client.
          */
         if (CBS_len(&session_id) != 0 &&
@@ -459,7 +459,7 @@ tls13_server_hello_retry_request_sent(struct tls13_ctx *ctx)
         /*
          * If the client has requested middlebox compatibility mode,
          * we MUST send a dummy CCS following our first handshake message.
-         * See RFC 8446 Appendix D.4.
+         * See RFC 9846 Appendix E.4.
          */
         if (ctx->hs->tls13.legacy_session_id_len > 0)
                 ctx->send_dummy_ccs_after = 1;
@@ -519,7 +519,7 @@ tls13_server_hello_sent(struct tls13_ctx *ctx)
         /*
          * If the client has requested middlebox compatibility mode,
          * we MUST send a dummy CCS following our first handshake message.
-         * See RFC 8446 Appendix D.4.
+         * See RFC 9846 Appendix E.4.
          */
         if ((ctx->handshake_stage.hs_type & WITHOUT_HRR) &&
             ctx->hs->tls13.legacy_session_id_len > 0)
@@ -572,7 +572,7 @@ tls13_server_check_certificate(struct tls13_ctx *ctx, SSL_CERT_PKEY *cpk,
 
         /*
          * The digitalSignature bit MUST be set if the Key Usage extension is
-         * present as per RFC 8446 section 4.4.2.2.
+         * present as per RFC 9846 section 4.5.1.2.
          */
         if (!(X509_get_key_usage(cpk->x509) & X509v3_KU_DIGITAL_SIGNATURE))
                 goto done;