What is TLS?

TLS is a cryptographic protocol that secures communications over a computer network. It runs above the transport layer (typically TCP) and below application protocols like HTTP, SMTP, or IMAP. The protocol provides three core guarantees: confidentiality through symmetric encryption, data integrity through message authentication codes, and endpoint authentication through public key certificates. TLS is the successor to SSL, with the first version (TLS 1.0) defined in RFC 2246 in 1999. The current standard is TLS 1.3, finalized in RFC 8446 in August 2018.

TLS operates through a handshake phase followed by a record protocol phase. In the handshake, the client and server negotiate a cipher suite, exchange cryptographic keys (using algorithms like Diffie-Hellman or ECDHE), and authenticate the server's identity by verifying its X.509 certificate against a trusted root store. TLS 1.3 reduced the handshake to a single round trip (1-RTT) for most connections, and supports 0-RTT for resumption. After the handshake, the record protocol protects application data in fragments, each encrypted and authenticated with the negotiated keys.

TLS is the foundation of HTTPS (port 443) but also secures other TCP-based protocols, including FTPS, SMTPS, and DNS over TLS (DoT). It is maintained by the IETF TLS Working Group. Most TLS implementations are based on OpenSSL, BoringSSL (Google), LibreSSL (OpenBSD), or NSS (Mozilla). While TLS provides strong transport security, its security depends entirely on proper certificate validation, cipher suite selection, and configuration hygiene. Attacks such as POODLE, BEAST, and Logjam exploited weaknesses in older protocol versions or specific cipher choices, leading to the deprecation of SSLv3, TLS 1.0, and TLS 1.1 by major standards bodies and browsers in 2020 and 2021.