What is Transport Layer Security (TLS)?
TLS is the successor to SSL, and the protocol that actually protects the web today. When a browser connects to a site over HTTPS, the two run a TLS handshake: the server presents its certificate to prove its identity, the browser checks it against the authorities it trusts, and the two agree on keys that encrypt everything sent afterward. From then on, nobody between them, whether on the coffee shop wifi, at the internet provider or anywhere along the route, can read or alter what passes.
It has versions. TLS 1.0 arrived in 1999 and 1.1 in 2006; both are now retired and refused by modern browsers. TLS 1.2, from 2008, is still widely used and safe when configured well. TLS 1.3, finalized in 2018, removed older weak options and cut the handshake to a single round trip, making secure connections faster as well as safer. It protects far more than web pages, too: email, messaging apps and most connections between servers run over TLS.
Why it matters
Why TLS matters
Without TLS there is no private web: no logins, no payments, no forms anyone could trust. It is also what lets a visitor know they reached the real site, because the certificate is tied to the domain. For a brand, TLS is invisible when it works and very visible when it does not. An expired certificate or an outdated configuration produces a full-page browser warning that stops most visitors at the door, and search engines, payment providers and security reviews all expect current versions. It is one of the few parts of a website where a single missed renewal can take everything offline in practice.
In practice
How TLS works in practice
- 01
For most sites TLS is handled by the host or CDN, which issues a certificate, keeps it renewed and negotiates the connection with each visitor. The configuration still deserves a check. We make sure the server accepts TLS 1.2 and 1.3 and nothing older, uses modern cipher settings, renews certificates automatically and sends the HSTS header, which tells browsers to use only secure connections for the domain from then on.
- 02
Renewal is now the thing to watch. The CA/Browser Forum, the industry body that sets the rules for certificates, is shortening their maximum lifetime in stages, down to 47 days by 2029, which makes manual renewal impractical. Automation through ACME, the protocol Let's Encrypt made standard, is the answer, with monitoring on top so that a failed renewal raises an alert days before any visitor sees a warning.
Watch out
What people get wrong about TLS
Calling it SSL and assuming the two are the same. The certificates are interchangeable, but a server that still supports actual SSL, or TLS 1.0 and 1.1, is flagged by every security scan. Second, thinking the certificate type decides the strength of the encryption; the protocol version and server settings do. Third, securing the website and forgetting everything around it: the staging site, the subdomains, the mail server and the API, all of which carry the same data and need the same protection.
