TLS, short for Transport Layer Security, is the set of rules two computers follow to talk privately over the internet. It scrambles the data so anyone listening in between sees noise, and it lets the browser confirm it is talking to the real server. It is the "S" doing the work in HTTPS, and it also protects email, APIs and many apps.
What happens in a TLS handshake
Before any page content moves, the browser and server run a short handshake:
- The browser says hello and lists the TLS versions and ciphers it supports.
- The server picks one and sends its certificate, which the browser verifies.
- Both sides use a key exchange to agree on a fresh session key that never crosses the network in readable form.
- From then on, every request and response is encrypted and checked for tampering with that session key.
TLS 1.3, published in 2018, cut the handshake to one round trip and removed older, weaker ciphers. That shorter handshake reduces the latency added to the first connection.
TLS versus SSL
SSL was the Netscape-era protocol TLS replaced. SSL 2.0 and 3.0 are broken and disabled in browsers, and TLS 1.0 and 1.1 were formally deprecated in 2021. Today a properly configured server offers TLS 1.2 and 1.3 only. People still say "SSL" out of habit; the technology in use is TLS.
Seeing TLS on a real site
In Chrome, open developer tools, go to the Security panel and reload any HTTPS page. It reports the protocol (for example TLS 1.3), the key exchange and the cipher. Online scanners such as Qualys SSL Labs grade a server's TLS setup and flag old versions still switched on.
When TLS settings become your problem
If your host or builder manages your site, TLS is configured for you and you rarely touch it. It becomes your problem when you run your own server, connect a payment provider that demands TLS 1.2 or newer, or receive a security questionnaire from a larger client asking which versions you allow.
Configuration mistakes to avoid
- Leaving TLS 1.0 or 1.1 enabled on a self-managed server for "compatibility". The browsers that needed them are long gone.
- Terminating TLS at a proxy and forwarding plain HTTP across an untrusted network to the origin.
- Assuming TLS secures the data once it arrives. It protects the trip only; stored data needs its own encryption.
- Disabling certificate checks in code to silence an error, which removes the protection against impostor servers.
Related terms
- HTTPS: web traffic carried inside TLS.
- SSL certificate: the identity proof used during the handshake.
- Encryption: the general technique TLS applies.
- Port: HTTPS with TLS normally listens on port 443.