TLS

TLS (Transport Layer Security) provides encryption, integrity, and authentication at the transport layer; it replaced SSL and underpins HTTPS, SMTPS, and more.

Purpose

It builds a secure channel over an untrusted network, preventing eavesdropping, tampering, and forgery.

Mechanism

Handshake phase: negotiate the TLS version and cipher suite, the server presents its certificate (optionally requesting a client certificate), session keys are negotiated with ECDHE, and the certificate is verified. Record layer: application data is encrypted with the negotiated symmetric key, with HMAC/AEAD for integrity. TLS 1.3 simplifies this to a 1-RTT handshake.

Use cases

HTTPS web encryption
SMTPS/IMAPS email
FTPS file transfer
gRPC over TLS

Examples

Input
```
TLS 1.3 + AES-GCM
```
Output
```
An encrypted channel
```
The 1-RTT handshake

Common errors

Relying on outdated TLS 1.0/1.1: Enforce TLS 1.2 or later; 1.3 preferred

Related terms

SSL (Secure Sockets Layer) is the early security protocol designed by Netscape; it has been replaced by TLS, though the name survives colloquially.

HTTPS is HTTP over TLS: it encrypts HTTP communication at the transport layer, providing confidentiality, integrity, and server authentication, and it is the modern web standard.

X.509 Certificate

An X.509 certificate binds a public key to an identity, signed by a CA for verification, containing validity, issuer, subject, and extension fields.

TLS certificate pinning embeds the expected certificate public key or hash in the client and rejects all other certificates, preventing man-in-the-middle attacks (including forged certificates issued by legitimate CAs).

References