Transport Layer Security (TLS)
Cryptographic protocol that encrypts data in transit between clients and servers.
What is TLS?
TLS encrypts network traffic so eavesdroppers cannot read or tamper with data in flight. When you visit https://, HTTP runs over TLS. The older name SSL is still used colloquially though SSL 3.0 is deprecated.
How a handshake works (simplified)
- Client connects and advertises supported cipher suites
- Server presents certificate proving domain identity
- Keys are exchanged; symmetric encryption secures the session
- Application data flows encrypted
Certificates
- Issued by Certificate Authorities (Let’s Encrypt, DigiCert, etc.)
- Bind a public key to a domain name
- Auto-renewal via ACME is standard on modern platforms
TLS termination
Encryption may end at a CDN, load balancer, or reverse proxy (termination), with optional re-encryption to backends (TLS passthrough or mTLS internally).
Best practices (informational)
- Enforce TLS 1.2+ (prefer 1.3)
- Use HSTS to force HTTPS in browsers
- Monitor certificate expiry
- Disable weak ciphers
Related terms
mTLS (mutual TLS) requires both client and server to present certificates — common in service meshes and zero-trust architectures.
What people get wrong
- Letting certificates expire. Still a top cause of self-inflicted outages; automate renewal (ACME) and alert two weeks out, not the morning of.
- Terminating TLS at the edge and forgetting the inside. Plaintext between the load balancer and backends undermines the whole model — re-encrypt or use mTLS internally where the network isn’t trusted.
- Testing HTTPS only in the browser. Older mobile clients, webhooks, and API consumers can fail on modern-only cipher configs; test with the clients you actually serve.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.