TLS Transport Layer Security

Definition

Transport Layer Security, or TLS, is a cryptographic protocol that secures data transmitted over a network by providing encryption, integrity verification, and authentication between communicating parties. It is the protocol behind HTTPS and secures many other network services, working through a handshake that negotiates cryptographic parameters and verifies the server's identity, typically using an X.509 certificate, before encrypted application data begins flowing.

Overview

TLS exists to solve a fundamental problem with data sent across shared networks: without protection, anyone able to observe network traffic can read or tamper with it, and a client has no inherent way to know it is actually communicating with the legitimate server it intends to reach rather than an impersonator. As the internet grew to carry sensitive information, from passwords to financial transactions, a standardized way to secure that traffic became essential rather than optional. Mechanically, a TLS connection begins with a handshake in which the client and server agree on a protocol version and cipher suite, the server presents an X.509 certificate to prove its identity, and both sides establish a shared set of symmetric encryption keys, often using asymmetric cryptography or a key exchange method during this negotiation specifically because asymmetric operations are computationally expensive for bulk data. Once the handshake completes, subsequent application data is encrypted and integrity-protected using the negotiated symmetric keys, which is far more efficient for the large volumes of data typically exchanged after the connection is established. Modern versions of the protocol have progressively removed older, weaker cipher options and simplified the handshake to reduce the number of round trips needed before encrypted data can flow. TLS differs from its predecessor, SSL, which it replaced after security weaknesses made SSL obsolete; the names are still often used interchangeably in casual usage even though SSL itself is no longer considered secure. It differs from mutual TLS in that standard TLS typically authenticates only the server to the client, while mutual TLS additionally requires the client to present its own certificate, authenticating both directions, which is common in service-to-service communication within controlled environments rather than general public-facing websites. In practice, TLS secures web browsing through HTTPS, protects email transmission between mail servers, secures API traffic between services, and underlies virtual private network protocols and countless other network applications that need confidentiality and integrity guarantees. Server operators obtain X.509 certificates from certificate authorities, configure supported cipher suites and protocol versions, and increasingly automate certificate renewal given industry-wide moves toward shorter certificate lifetimes. TLS protects data in transit but says nothing about how data is protected once it reaches its destination and is stored, which is why it is typically paired with separate encryption-at-rest measures for complete data protection. Misconfiguration, such as supporting outdated protocol versions or weak cipher suites, can undermine its protections even when the protocol itself is sound, and performance overhead from the handshake, while much reduced in modern versions, still matters for latency-sensitive applications, motivating techniques like session resumption to avoid repeating a full handshake on every connection.

Specification

• Provides encryption, integrity verification, and server authentication
• Negotiates cryptographic parameters through an initial handshake
• Relies on X.509 certificates to verify server identity
• Uses asymmetric methods during handshake and symmetric keys for bulk data
• Successor to the now-deprecated SSL protocol
• Supports session resumption to reduce handshake overhead on repeat connections
• Underlies HTTPS, secure email transmission, and API traffic protection
• Extended by mutual TLS for two-way client and server authentication

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity