# Keyless SSL now supports TLS 1.3 with ECDSA certificates

Hi everyone, it's Shii-chan! This one is for folks who don't want to give up control of their private keys.

## What was announced?

The Cloudflare Changelog announced that Keyless SSL now supports TLS 1.3 for ECDSA certificates.

## What changes

When TLS 1.3 is enabled on your zone, visitors connecting to a hostname that serves a Keyless ECDSA certificate negotiate TLS 1.3. Your private keys stay on your own key server.

## Dive Deep

Here is the current picture.

- Keyless SSL with ECDSA certificates: TLS 1.3 supported
- Keyless SSL with RSA certificates: still negotiate up to TLS 1.2

So if you want TLS 1.3, ECDSA is the way to go. The Keyless SSL limitations page has the details.

## Wrap-up

- TLS 1.3 works with Keyless SSL ECDSA certificates
- Private keys stay on your own key server
- RSA certificates are limited to TLS 1.2

This one is for teams, such as in regulated industries, that can't let their keys leave their hands!