Home / Knowledge hub / TLS
Knowledge hub
TLS
The protocol that encrypts traffic between a browser and a server.
What it means
TLS, which stands for Transport Layer Security, is the protocol that protects data as it travels between two systems, most often a browser and a web server. It does three jobs: it encrypts the traffic, it detects tampering, and it lets the client check who the server is.
It is what puts the padlock in the browser, and it is the S in HTTPS. TLS replaced SSL, and people still say SSL when they mean TLS, though SSL itself is long obsolete. The protocol has been revised several times, and the current version is much stronger than the early ones.
Why it matters
Without TLS, anyone on the path between your user and your server, such as a shared Wi-Fi network, can read or change what is sent: passwords, session cookies, payment details. Browsers now warn about sites that lack it, and many standards expect it for any sensitive data.
Configured badly, it gives false comfort. An expired certificate stops customers reaching you, a weak setting leaves a door open for downgrade attacks, and a service-to-service call without verification can be redirected to an impostor. Encryption in transit is a base requirement of most customer questionnaires.
How it shows up
You meet TLS at the edge of your site, at a load balancer or CDN, and also between internal services, databases and third-party APIs. The current version is TLS 1.3, defined in RFC 8446. TLS 1.0 and 1.1 were formally deprecated by the IETF in RFC 8996, so they should be switched off.
Common problems: old protocol versions still enabled, weak cipher suites, certificates that expire unnoticed (see certificate expiry), apps that skip certificate checks in code to "make the error go away", and mixed content on pages. Add HSTS so browsers insist on the secure version.
Questions people ask
TLS, answered
Is TLS the same as SSL?
TLS is the successor to SSL. SSL versions 2 and 3 are obsolete and insecure. Many people and some products still say SSL, but the protocol in use today is TLS.
Check that older versions are switched off.
Which TLS version should we use?
TLS 1.3 where you can, with TLS 1.2 as the minimum for compatibility. Disable TLS 1.0 and 1.1, which the IETF has deprecated.
IETF's RFC 9325 gives current recommendations.
Does TLS make my application secure?
No. It protects the data on its way. It does nothing about flaws in your own code, such as broken access control or injection. A site can be fully encrypted and still leak data to the wrong account.
Treat it as one layer.
Do internal services need TLS too?
Often yes. Traffic inside a network can be read by someone who gets a foothold, and many compliance frameworks expect encryption in transit between services.
Mutual TLS adds proof of identity in both directions. See mTLS.
How do we check our TLS setup?
Use an external test tool to see versions, ciphers and certificate details, and monitor certificate dates. Also look in your code for disabled verification.
Repeat after infrastructure changes.
Related
Terms that sit next to this one
HTTPS
The encrypted web protocol, and the minimum for anything with a login.
Certificate expiry
A TLS certificate running out, which breaks trust and often the whole site.
Cipher suite
The set of algorithms two sides agree to use when they set up a secure connection.
HSTS
A header telling browsers to use HTTPS only for your site, every time.
Encryption in transit
Protecting data while it travels between a browser and your servers.
Is encryption hiding a weak app?
Encryption protects data on the way, not logic flaws behind it. We test the running app and report what we actually exploited, with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.