Transport Layer Security (TLS) is the protocol that encrypts and authenticates data moving between two systems over a network, such as a browser and a website, an app and an API, or two mail servers. It is what puts the “S” in HTTPS. TLS uses digital certificates to prove a server’s identity, then sets up encryption so others on the path cannot read or quietly alter what is sent.
At a glance
- TLS protects data in transit; it does not protect data once it is stored.
- A certificate, issued by a certificate authority, lets the client check it is talking to the right server.
- TLS 1.2 and TLS 1.3 are the versions current guidance recommends; older versions are widely deprecated.
- Most web and API traffic, much email traffic and many VPNs rely on TLS.
- Certificate expiry and outdated settings are common causes of outages and audit findings.
What problem it solves
Data crossing the internet passes through networks you don’t control: public Wi-Fi, carriers, cloud providers. Without encryption, anyone in that path could read passwords, payment details or business data, or change it in transit. Without authentication, a user could be steered to a convincing fake server, the kind of interception described in a man-in-the-middle attack.
TLS addresses both. It encrypts the session so intercepted traffic is unreadable, checks integrity so tampering is detected, and uses certificates so the client can verify the server’s identity. For buyers, it is also a compliance baseline: frameworks and customer security questionnaires routinely ask whether data is encrypted in transit, and TLS is the usual answer.
How it works
Handshake. When a client connects, it and the server agree on a TLS version and a set of cryptographic algorithms. The server presents its certificate, and the client checks that it was issued by a trusted certificate authority, matches the name it asked for and has not expired.
Key exchange. The two sides use public key cryptography to agree on temporary session keys without sending those keys across the network. TLS 1.3 simplified this step and removed many older options considered weak.
Encrypted session. The rest of the conversation is protected with fast symmetric encryption, plus integrity checks that detect changes.
Mutual TLS. In some setups, such as service-to-service or partner API connections, the client also presents a certificate so both sides are authenticated.
Where it ends. TLS is often terminated at a load balancer, content delivery network or web application firewall so traffic can be inspected or routed. Whether traffic is re-encrypted from there to your servers depends on how it is configured, and is worth checking.
When it matters for buyers
- When a site, app or API faces customers. Certificate management and protocol settings directly affect availability and trust warnings.
- When choosing a CDN, WAF or load balancer. Ask where TLS is terminated, who holds the private keys and whether traffic is re-encrypted to your origin.
- When buying a secure web gateway or firewall. TLS inspection is a major part of what these tools do and of how they perform; the secure web gateway and web application and API protection options handle it in different places.
- When an audit or questionnaire arrives. Expect questions on versions enabled, certificate management and encryption in transit.
- When legacy systems are involved. Older devices or applications may not support current versions, which can block a clean upgrade.
Questions to ask vendors
- Which TLS versions and cipher settings do you support, and can older versions be disabled?
- Where is TLS terminated in your service, and is traffic re-encrypted to our systems?
- Who holds the private keys, and can we bring our own certificates?
- Do you automate certificate renewal, and how will we be warned before expiry?
- If you inspect encrypted traffic, what is the performance impact and how are exemptions handled?
- Do you support mutual TLS for service or partner connections?
How it differs from SSL
Secure Sockets Layer (SSL) was the original protocol for encrypted web connections. Its versions had design flaws and have been retired; TLS is the successor that fixed them, and later TLS versions have retired weak options in turn. The terms are often used interchangeably in everyday speech, and “SSL certificate” is still a common product name, but the certificate works with TLS. When a vendor or auditor says “SSL,” check which protocol versions they actually mean.