What Is TLS? – Definition and How It Works
Learn what TLS provides, how versions differ, what forward secrecy means, and why the handshake identifies client software.
Transport Layer Security encrypts and authenticates a connection. It is what turns HTTP into HTTPS, and it protects most other internet protocols in the same way.
1. The Three Properties
- Confidentiality — content cannot be read in transit.
- Integrity — modification is detected.
- Authentication — the server proves it is the one requested.
The third is the one people forget, and it is what makes the other two meaningful. Encryption to an unverified party protects nothing.
2. The Versions
| Version | Status |
|---|---|
| SSL 2.0 and 3.0 | Obsolete and insecure |
| TLS 1.0 and 1.1 | Deprecated, removed from browsers |
| TLS 1.2 | Widely supported, still common |
| TLS 1.3 | Current — faster, simpler, fewer options |
TLS 1.3 removed legacy algorithms and reduced the handshake to a single round trip, with zero-round-trip resumption available.
3. Certificates Provide Identity
A certificate binds a public key to a hostname and is signed by an authority the client trusts. The client verifies hostname, validity period, chain to a trusted root, and revocation status.
A domain-validated certificate proves control of a domain and nothing about the organisation — which is why a valid certificate is not evidence of trustworthiness.
4. Forward Secrecy
Modern key exchange uses ephemeral material, so the session key cannot be recovered later even if the server's private key is compromised.
That means recorded traffic stays protected, which is a substantially stronger guarantee than earlier key-exchange methods provided.
5. The Handshake Identifies the Client
The client hello is sent in the clear and lists supported versions, cipher suites, extensions, and curves — in an order chosen by the implementation.
That composition is characteristic of the software making the connection, which is the basis of TLS fingerprinting. It is available before any HTTP header arrives, and it is why a request claiming to be a browser over a library's handshake contradicts itself.
6. Where It Fails
| Failure | Cause |
|---|---|
| Protocol version alert | No shared version |
| Handshake failure | No shared cipher suite |
| Unknown authority | Chain does not reach a trusted root |
| Hostname mismatch | Certificate does not cover the requested name |
| Expired certificate | Renewal did not happen |
Forcing a version with a command-line client separates the first two immediately.
7. Never Disable Verification
Turning off certificate checking is a one-line change that removes the identity guarantee for every subsequent request. Encryption without identity means an interceptor can terminate and re-encrypt undetected.
Where an internal authority is used, trust its root instead.
8. Summary
TLS provides confidentiality, integrity, and server authentication, with TLS 1.3 the current version and forward secrecy protecting recorded traffic.
Certificates supply identity, verification is what makes encryption meaningful, and the handshake's composition identifies client software before any request is sent.