<!-- NOTE: THIS FILE IS AUTOGENERATED. DO NOT EDIT BY HAND. -->
<!-- see templates/registry/markdown/attribute_namespace.md.j2 -->

# TLS

- [TLS Attributes](#tls-attributes)
- [TLS Deprecated Attributes](#tls-deprecated-attributes)

## TLS Attributes

This document defines semantic convention attributes in the TLS namespace.

| Attribute | Type | Description | Examples | Stability |
|---|---|---|---|---|
| <a id="tls-cipher" href="#tls-cipher">`tls.cipher`</a> | string | String indicating the [cipher](https://datatracker.ietf.org/doc/html/rfc5246#appendix-A.5) used during the current connection. [1] | `TLS_RSA_WITH_3DES_EDE_CBC_SHA`; `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-certificate" href="#tls-client-certificate">`tls.client.certificate`</a> | string | PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. | `MII...` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-certificate-chain" href="#tls-client-certificate-chain">`tls.client.certificate_chain`</a> | string[] | Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. | `["MII...", "MI..."]` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-hash-md5" href="#tls-client-hash-md5">`tls.client.hash.md5`</a> | string | Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | `0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-hash-sha1" href="#tls-client-hash-sha1">`tls.client.hash.sha1`</a> | string | Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | `9E393D93138888D288266C2D915214D1D1CCEB2A` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-hash-sha256" href="#tls-client-hash-sha256">`tls.client.hash.sha256`</a> | string | Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. | `0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-issuer" href="#tls-client-issuer">`tls.client.issuer`</a> | string | Distinguished name of [subject](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6) of the issuer of the x.509 certificate presented by the client. | `CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-ja3" href="#tls-client-ja3">`tls.client.ja3`</a> | string | A hash that identifies clients based on how they perform an SSL/TLS handshake. | `d4e5b18d6b55c71272893221c96ba240` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-not-after" href="#tls-client-not-after">`tls.client.not_after`</a> | string | Date/Time indicating when client certificate is no longer considered valid. | `2021-01-01T00:00:00.000Z` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-not-before" href="#tls-client-not-before">`tls.client.not_before`</a> | string | Date/Time indicating when client certificate is first considered valid. | `1970-01-01T00:00:00.000Z` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-subject" href="#tls-client-subject">`tls.client.subject`</a> | string | Distinguished name of subject of the x.509 certificate presented by the client. | `CN=myclient, OU=Documentation Team, DC=example, DC=com` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-client-supported-ciphers" href="#tls-client-supported-ciphers">`tls.client.supported_ciphers`</a> | string[] | Array of ciphers offered by the client during the client hello. | `["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"]` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-curve" href="#tls-curve">`tls.curve`</a> | string | String indicating the curve used for the given cipher, when applicable | `secp256r1` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-established" href="#tls-established">`tls.established`</a> | boolean | Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. | `true` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-next-protocol" href="#tls-next-protocol">`tls.next_protocol`</a> | string | String indicating the protocol being tunneled. Per the values in the [IANA registry](https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. | `http/1.1` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-protocol-name" href="#tls-protocol-name">`tls.protocol.name`</a> | string | Normalized lowercase protocol name parsed from original string of the negotiated [SSL/TLS protocol version](https://docs.openssl.org/1.1.1/man3/SSL_get_version/#return-values) | `ssl`; `tls` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-protocol-version" href="#tls-protocol-version">`tls.protocol.version`</a> | string | Numeric part of the version parsed from the original string of the negotiated [SSL/TLS protocol version](https://docs.openssl.org/1.1.1/man3/SSL_get_version/#return-values) | `1.2`; `3` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-resumed" href="#tls-resumed">`tls.resumed`</a> | boolean | Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. | `true` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-certificate" href="#tls-server-certificate">`tls.server.certificate`</a> | string | PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. | `MII...` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-certificate-chain" href="#tls-server-certificate-chain">`tls.server.certificate_chain`</a> | string[] | Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. | `["MII...", "MI..."]` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-hash-md5" href="#tls-server-hash-md5">`tls.server.hash.md5`</a> | string | Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | `0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-hash-sha1" href="#tls-server-hash-sha1">`tls.server.hash.sha1`</a> | string | Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | `9E393D93138888D288266C2D915214D1D1CCEB2A` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-hash-sha256" href="#tls-server-hash-sha256">`tls.server.hash.sha256`</a> | string | Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. | `0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-issuer" href="#tls-server-issuer">`tls.server.issuer`</a> | string | Distinguished name of [subject](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6) of the issuer of the x.509 certificate presented by the client. | `CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-ja3s" href="#tls-server-ja3s">`tls.server.ja3s`</a> | string | A hash that identifies servers based on how they perform an SSL/TLS handshake. | `d4e5b18d6b55c71272893221c96ba240` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-not-after" href="#tls-server-not-after">`tls.server.not_after`</a> | string | Date/Time indicating when server certificate is no longer considered valid. | `2021-01-01T00:00:00.000Z` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-not-before" href="#tls-server-not-before">`tls.server.not_before`</a> | string | Date/Time indicating when server certificate is first considered valid. | `1970-01-01T00:00:00.000Z` | ![Development](https://img.shields.io/badge/-development-blue) |
| <a id="tls-server-subject" href="#tls-server-subject">`tls.server.subject`</a> | string | Distinguished name of subject of the x.509 certificate presented by the server. | `CN=myserver, OU=Documentation Team, DC=example, DC=com` | ![Development](https://img.shields.io/badge/-development-blue) |

**[1] `tls.cipher`:** The values allowed for `tls.cipher` MUST be one of the `Descriptions` of the [registered TLS Cipher Suits](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#table-tls-parameters-4).

---

`tls.protocol.name` has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

| Value  | Description | Stability |
|---|---|---|
| `ssl` | ssl | ![Development](https://img.shields.io/badge/-development-blue) |
| `tls` | tls | ![Development](https://img.shields.io/badge/-development-blue) |

## TLS Deprecated Attributes

Describes deprecated `tls` attributes.

| Attribute | Type | Description | Examples | Stability |
|---|---|---|---|---|
| <a id="tls-client-server-name" href="#tls-client-server-name">`tls.client.server_name`</a> | string | Deprecated, use `server.address` instead. | `opentelemetry.io` | ![Deprecated](https://img.shields.io/badge/-deprecated-red)<br>Replaced by `server.address`. |
