Skip to main content
MI Support IT logo

IT security

What is TLS?

TLS is the protocol behind the padlock in the browser: it encrypts traffic and proves who you are talking to. See how the handshake works.

In short

TLS (Transport Layer Security) is the protocol that secures communication on the internet: it encrypts the traffic between two parties and at the same time uses certificates to prove who you are talking to.

It is TLS that turns http into https and draws the padlock in the browser, but the protocol protects far more than web pages: mail between servers, API calls, VPN and cloud services.

TLS replaced SSL, and although the SSL name lingers in everyday speech, all SSL versions and TLS 1.0 and 1.1 are obsolete and phased out; modern operations use TLS 1.2 and preferably TLS 1.3, which is both faster and stricter. In the handshake, the server proves its identity with an X.509 certificate, after which the parties exchange keys and encrypt all traffic.

Operationally, expired certificates are the classic pitfall, and certificate lifetimes keep getting shorter, so automation has become a requirement. MI Support IT operates customers' TLS certificates and configurations as a standing service.

Back to the glossary

What is TLS?

TLS (Transport Layer Security) is the internet's security protocol: It layers encryption and proof of identity on top of an ordinary network connection. When the browser shows https and the padlock, TLS is doing the work, but the protocol protects far more than web pages: mail transport between servers, API integrations, database connections and most cloud services.

TLS delivers three guarantees at once: confidentiality (the traffic is encrypted), integrity (it cannot be altered in transit) and authenticity (the server is who the certificate says it is).

SSL vs. TLS: the naming confusion

TLS is the successor to SSL (Secure Sockets Layer) from the 1990s, and in everyday speech many people still say "SSL certificate", even though it is really TLS being used. Technically the matter is clear: All SSL versions, plus TLS 1.0 and 1.1, are broken or obsolete and formally phased out. Modern operations use TLS 1.2 as a minimum and preferably TLS 1.3 (RFC 8446 from 2018), which is both faster (the handshake completes in a single round trip) and stricter, because all weak algorithms and insecure cipher suites have been removed from the protocol. If a security scan finds old protocol versions on your systems, it is a finding that must be closed.

The handshake: how a secure connection is established

When a client contacts a server over TLS, three things happen in under 100 milliseconds:

  1. Identity: The server presents its X.509 certificate, issued by a trusted certificate authority. The client verifies the chain up to a root it trusts.
  2. Key exchange: The parties run elliptic curve Diffie-Hellman and arrive at a shared session key with forward secrecy, so old traffic remains secure even if the server's key later leaks.
  3. Encryption: All further traffic is encrypted symmetrically (typically AES) with the session key.

Without a valid certificate, the chain breaks down: browsers show warnings, API calls fail, and mail can fall back to unencrypted transport.

Operational reality: certificates that expire

The technology behind TLS is solid. What trips companies up in practice is certificate administration. Expired certificates are a classic cause of sudden outages of websites, integrations and internal systems, and the problem is growing: The maximum certificate lifetime has been cut several times and will be shortened further in the coming years. Manual renewal in a calendar does not scale. Automated issuance and renewal via ACME and managed monitoring of the entire portfolio has become an operational requirement. See also the TLS certificate lifecycle.

How MI Support IT can help

We operate TLS as a standing service: an overview of all certificates, automated renewal, modern protocol and cipher configuration on servers, mail and equipment, all under PKI management and your IT security. Contact us before the next expired certificate finds you.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting