How TLS Works

On this page
  1. What does TLS provide?
  2. How does a TLS connection come together?

TLS (Transport Layer Security) is the protocol that secures the overwhelming majority of internet traffic — every https:// connection, plus email, VPNs, and more. It combines the cryptographic building blocks into three practical guarantees: your traffic is encrypted, tampering is detectable, and you are really talking to the server you think you are.

What does TLS provide?#

GuaranteeDelivered by
ConfidentialitySymmetric encryption of the session
IntegrityMessage authentication codes
AuthenticationThe server’s certificate

The elegance of TLS is how it combines tools: it uses slow asymmetric cryptography only briefly — to authenticate the server and agree on a key — then switches to fast symmetric encryption for the actual data. Modern TLS also guarantees perfect forward secrecy, so recording traffic today does not pay off if a key leaks later.

How does a TLS connection come together?#

At a high level, the handshake does four things:

  1. Agree on the protocol version and cipher suite.
  2. Authenticate the server via its certificate (validated through PKI).
  3. Establish a shared secret using ephemeral key exchange.
  4. Switch to symmetric encryption for the session.

After that, all application data flows encrypted and integrity-protected until the connection closes.

TLS is the backbone of transport security. See its inner workings in the TLS handshake and more at the Network Security hub.

Frequently asked questions#

What does TLS actually provide?

TLS provides three guarantees: confidentiality (traffic is encrypted), integrity (tampering is detectable), and authentication (you are talking to the real server, verified by its certificate). It is what turns HTTP into HTTPS and secures email, VPNs, and countless other protocols beneath the surface.

What is the difference between TLS and SSL?

SSL (Secure Sockets Layer) is the deprecated predecessor of TLS (Transport Layer Security). All SSL versions are broken and should not be used. "SSL" persists colloquially — people say "SSL certificate" — but the actual protocol in use today is TLS, currently version 1.3.

Sources & further reading