Spell out differences in naming and fix link to RFC

Author: RebeccaTamachiro

src/content/docs/spectrum/reference/configuration-options.mdx

@@ -134,4 +134,4 @@ The cipher suites below are ordered based on how they appear in the ClientHello,
 | AES128-SHA                        | ✅       | ✅       | ❌       |
 | AES256-SHA                        | ✅       | ✅       | ❌       |
 
-[^1]: Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2. Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3 (IETF TLS 1.3 draft 21). BoringSSL also hard-codes cipher preferences in this order for TLS 1.3.
+[^1]: Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2. Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3 ([RFC 8446](https://www.rfc-editor.org/rfc/rfc8446.html)). BoringSSL also hard-codes cipher preferences in this order for TLS 1.3. Refer to [TLS 1.3 cipher suites](/ssl/origin-configuration/cipher-suites/#tls-13-cipher-suites) for details.

src/content/docs/ssl/edge-certificates/additional-options/cipher-suites/supported-cipher-suites.mdx

@@ -41,5 +41,5 @@ Cloudflare supports the following cipher suites by default. If needed, you can [
 
 Ciphers `AEAD-AES128-GCM-SHA256`, `AEAD-AES256-GCM-SHA384`, and `AEAD-CHACHA20-POLY1305-SHA256` are automatically supported by your zone if you [enable TLS 1.3](/ssl/edge-certificates/additional-options/tls-13/#enable-tls-13).
 
-TLS 1.3 uses the same cipher suite space as previous versions of TLS, but defines these cipher suites differently. TLS 1.3 only specifies the symmetric ciphers and cannot be used for TLS 1.2. Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3 (IETF TLS 1.3 draft 21). BoringSSL also hard-codes cipher preferences in this order for TLS 1.3.
+TLS 1.3 uses the same cipher suite space as previous versions of TLS, but defines these cipher suites differently. TLS 1.3 only specifies the symmetric ciphers and cannot be used for TLS 1.2. Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3 ([RFC 8446](https://www.rfc-editor.org/rfc/rfc8446.html)). BoringSSL also hard-codes cipher preferences in this order for TLS 1.3.
 :::

src/content/docs/ssl/origin-configuration/cipher-suites.mdx

@@ -38,6 +38,18 @@ The list order is based on how the cipher suites appear in the [ClientHello](htt
 | AES256-SHA                         | ✅       | ✅       | ✅       | ❌       |
 | DES-CBC3-SHA                       | ✅       | ❌       | ❌       | ❌       |
 
+### TLS 1.3 cipher suites
+
+Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2 ([RFC 8446](https://www.rfc-editor.org/rfc/rfc8446.html)).
+
+Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3. BoringSSL also hard-codes cipher preferences in the order above for TLS 1.3.
+
+Based on BoringSSL, Cloudflare system will return the names listed above. However, the corresponding names defined in  [RFC 8446](https://www.rfc-editor.org/rfc/rfc8446.html) are the following:
+
+- `TLS_AES_128_GCM_SHA256`
+- `TLS_AES_256_GCM_SHA384`
+- `TLS_CHACHA20_POLY1305_SHA256`
+
 ## Match on origin
 
 Cloudflare will present the cipher suites to your origin and your server will select whichever cipher suite it prefers.
@@ -51,4 +63,4 @@ ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RS
 ssl_prefer_server_ciphers on;
 ```
 
-[^1]: *Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2. Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3 (IETF TLS 1.3 draft 21). BoringSSL also hard-codes cipher preferences in this order for TLS 1.3.*
+[^1]: Refer to [TLS 1.3 cipher suites](#tls-13-cipher-suites) for details.