SSL/TLS

Whenever you visit a website using HTTPS, your browser needs a secure way to communicate with the web server.

For example, when you log in to a website, you don't want your username and password traveling across the network in a form that attackers can easily read or modify.

This is where TLS comes in.

TLS (Transport Layer Security) is a cryptographic protocol designed to provide secure communication over a network.

You may also hear the term SSL (Secure Sockets Layer). SSL was the predecessor to TLS and is now obsolete.

So, the important thing to remember is:

SSL is the old technology. TLS is the modern technology used today.

Why Do We Need TLS?

Without encryption and authentication, an attacker who can observe network traffic may be able to read or manipulate information.

TLS helps provide three major security properties:

Confidentiality

Encrypts communication so unauthorized parties cannot easily read it.

Integrity

Helps detect whether data was modified while being transmitted.

Authentication

Helps the client verify the identity of the server using digital certificates.

Browser
   ║
   ║  Protected by TLS
   ║
Server

SSL vs TLS

SSL and TLS are related, but they are not the same protocol.

Today, when someone says "SSL certificate", they usually mean a TLS certificate used for HTTPS.

How Does TLS Work?

TLS uses several cryptographic techniques together rather than relying on one algorithm.

A simplified process looks like this:

Browser                         Server

   |──── ClientHello ──────────→|
   |←──── ServerHello ──────────|
   |←──── Certificate ──────────|
   |                             |
   |     Key Establishment       |
   |                             |
   |════════ Secure Session ═════|
   |                             |
   |──── Encrypted Data ────────→|
   |←──── Encrypted Data ────────|

The exact handshake differs between TLS versions and negotiated options, but the basic goal is to authenticate the server and establish keys for protecting the connection.

TLS Handshake

The TLS handshake is the process used to establish the security parameters for a TLS connection.

During the handshake, the client and server negotiate things such as:

• TLS version

• Cryptographic algorithms

• Session keys

• Server authentication

After the handshake is complete, application data can be protected using the established cryptographic keys.

Digital Certificates

One important part of TLS is the digital certificate.

A certificate binds a domain name to a public key and is digitally signed by a trusted Certificate Authority (CA).

For example:

Website Domain
      ↓
Digital Certificate
      ↓
Public Key
      ↓
Certificate Authority Signature

When your browser connects to a website, it can verify the certificate and check things such as:

• Is the certificate valid?

• Does it cover the requested domain?

• Is it within its validity period?

• Is it trusted through an appropriate certificate chain?

If the checks succeed, the browser can continue the secure connection.

Certificate Authority

A Certificate Authority (CA) is a trusted organization that issues or signs digital certificates.

The basic trust relationship looks like:

Certificate Authority
          ↓
    Signs Certificate
          ↓
    Website Server
          ↓
        Browser
      Verifies It

Operating systems and browsers maintain collections of trusted CA certificates.

This allows the browser to establish trust in certificates without already knowing the website's public key.

Public-Key and Symmetric Cryptography in TLS

TLS combines different cryptographic techniques.

Public-Key Cryptography

Used for purposes such as:

• Server authentication

• Secure key establishment

Symmetric Cryptography

Used to protect the actual application data after the handshake.

Why?

Because symmetric encryption is generally much faster for large amounts of data.

So, conceptually:

Public-Key Cryptography
          ↓
Authentication + Key Establishment
          ↓
Symmetric Encryption
          ↓
Encrypted Application Data

This combination provides both security and efficiency.

TLS and HTTPS

HTTPS is essentially HTTP protected using TLS.

Without TLS:

HTTP
 ↓
Network

With TLS:

HTTP
 ↓
TLS
 ↓
Network

So when you visit:

https://example.com

your browser uses HTTPS, with TLS providing protection for the HTTP communication.

What Does TLS Protect?

Suppose you log in to a website.

Your browser sends information such as:

Username
Password
Session Data

With HTTPS/TLS:

Browser
   ↓
TLS Encryption
   ↓
Encrypted Network Traffic
   ↓
Server

An attacker who intercepts the traffic should not be able to simply read the protected application data.

TLS also helps detect unauthorized modification of protected traffic.

TLS Does Not Make Everything Secure

This is an important point.

Seeing the padlock or HTTPS does not mean that a website itself is trustworthy.

TLS helps secure the connection between your device and the server.

It does not guarantee that:

• The website is honest

• The website has no vulnerabilities

• The information you enter will be handled responsibly

• The content is safe

For example, a malicious website can still use a valid TLS certificate.

So:

HTTPS protects the connection, not the honesty of the website.

TLS Versions

TLS has gone through several versions.

The major versions you may encounter are:

• TLS 1.0

• TLS 1.1

• TLS 1.2

• TLS 1.3

TLS 1.0 and TLS 1.1 are obsolete and should not be used.

Modern systems generally prefer TLS 1.2 or TLS 1.3, with TLS 1.3 providing a more streamlined handshake and modern cryptographic design.

TLS vs Encryption

TLS is more than just encryption.

It combines multiple security mechanisms to provide:

TLS
├── Authentication
├── Encryption
├── Integrity Protection
└── Secure Key Establishment

This is why it is more accurate to say:

TLS is a security protocol that uses cryptography to protect network communication.

Where Is TLS Used?

TLS is not limited to websites.

It can be used to protect many types of network communication, including:

• HTTPS

• Secure email connections

• APIs

• Database connections

• Messaging systems

• Other application protocols

Whenever an application needs secure communication over an untrusted network, TLS can be useful.

Conclusion

TLS (Transport Layer Security) is a cryptographic protocol that protects network communication by providing confidentiality, integrity, and authentication.

The basic process is:

Client
  ↓
TLS Handshake
  ↓
Certificate Verification
  ↓
Key Establishment
  ↓
Secure Encrypted Session
  ↓
Application Data

The most important things to remember are:

• SSL → Old and obsolete

• TLS → Modern security protocol

• Certificate → Helps authenticate the server

• Public-key cryptography → Used for authentication/key establishment

• Symmetric cryptography → Protects the actual session data

• HTTPS → HTTP protected by TLS

The easiest way to remember it is:

🔐 TLS creates a secure channel between applications communicating over a network.