How TLS Works
TLS (Transport Layer Security) is the protocol that secures the overwhelming majority of internet
traffic — every https:// connection, plus email, VPNs, and more. It combines the cryptographic
building blocks into three practical guarantees: your traffic is encrypted, tampering is
detectable, and you are really talking to the server you think you are.
What does TLS provide?#
| Guarantee | Delivered by |
|---|---|
| Confidentiality | Symmetric encryption of the session |
| Integrity | Message authentication codes |
| Authentication | The server’s certificate |
The elegance of TLS is how it combines tools: it uses slow asymmetric cryptography only briefly — to authenticate the server and agree on a key — then switches to fast symmetric encryption for the actual data. Modern TLS also guarantees perfect forward secrecy, so recording traffic today does not pay off if a key leaks later.
How does a TLS connection come together?#
At a high level, the handshake does four things:
- Agree on the protocol version and cipher suite.
- Authenticate the server via its certificate (validated through PKI).
- Establish a shared secret using ephemeral key exchange.
- Switch to symmetric encryption for the session.
After that, all application data flows encrypted and integrity-protected until the connection closes.
TLS is the backbone of transport security. See its inner workings in the TLS handshake and more at the Network Security hub.
Frequently asked questions#
What does TLS actually provide?
TLS provides three guarantees: confidentiality (traffic is encrypted), integrity (tampering is detectable), and authentication (you are talking to the real server, verified by its certificate). It is what turns HTTP into HTTPS and secures email, VPNs, and countless other protocols beneath the surface.
What is the difference between TLS and SSL?
SSL (Secure Sockets Layer) is the deprecated predecessor of TLS (Transport Layer Security). All SSL versions are broken and should not be used. "SSL" persists colloquially — people say "SSL certificate" — but the actual protocol in use today is TLS, currently version 1.3.