TLS / SSL
Cryptographic protocols designed to provide communications security over a computer network.
Detailed Explanation
SSL (Secure Sockets Layer) is the predecessor to TLS (Transport Layer Security). While people still use the term 'SSL', most modern connections use TLS 1.2 or 1.3. These protocols provide three key things: Encryption (hiding data), Authentication (ensuring you're talking to the right server), and Integrity (ensuring data hasn't been tampered with).
Quick Summary
TLS is the protocol that encrypts and authenticates traffic between two endpoints, what powers HTTPS, secure SMTP, and most encrypted protocols on the internet. SSL is its deprecated predecessor; the names are used interchangeably in conversation but in code it's all TLS now.
Key Takeaways
- TLS 1.3 (2018) is the current standard, fewer round trips, removed legacy crypto, mandatory forward secrecy.
- Disable TLS 1.0 and 1.1; they have known weaknesses and are out of compliance for PCI/SOC2.
- Handshake: client and server agree on a cipher suite, server presents a certificate, both derive session keys.
- Certificates are issued by a Certificate Authority (CA) in a chain back to a root browsers trust.
- Mutual TLS (mTLS) extends the same auth model to the client, common in service meshes and B2B APIs.
When to use it
- HTTPS for web traffic, the dominant use case.
- Encrypting database connections, message queues, and inter-service RPC.
- Mutual TLS for service-to-service authentication in zero-trust networks.
- Securing SMTP, IMAP, and other protocols that started life unencrypted.
Common Mistakes
- Allowing TLS 1.0/1.1 or weak cipher suites for "compatibility" with ancient clients.
- Self-signed certificates in production, browsers and clients reject them, and users learn to ignore warnings.
- Forgetting cert renewal, Let's Encrypt certs last 90 days; automated renewal is non-optional.
- Pinning certificates in mobile apps without a rotation strategy, then bricking the app when the cert changes.
TLS / SSL, Frequently Asked
TLS vs. SSL, which term is correct?
TLS. SSL 3.0 was the last SSL version; everything since (TLS 1.0 through 1.3) is TLS. The terms are used interchangeably colloquially, but technically nothing modern uses SSL.
What's mutual TLS (mTLS)?
Standard TLS authenticates only the server to the client. mTLS adds client-side certificates so both sides prove who they are. Common in service meshes, zero-trust networks, and high-security B2B APIs.
Why do certificates expire?
To limit damage from compromised keys and force regular validation that the holder still controls the domain. Shorter lifetimes (90 days for Let's Encrypt, moving toward 47 days industry-wide) require automation but reduce risk.