What Is TLS? A Look at the Transport Layer Security Protocol

Whether it’s making an online payment to a vendor or a customer signing up for something on your website, there’s a stream of sensitive and confidential data that’s being transmitted to or from a server or a client. And to protect that data in transit, transport layer security (TLS) is what makes the internet world go around.   

TLS Meaning: What Is Transport Layer Security?  

Transport layer security is a cryptographic protocol that encrypts data transmitted over the internet, ensuring private and secure communication between computers. It’s what puts the padlock icon in your browser and enables the “https” you see in web addresses. 

TLS is the bigger, tougher, and more secure “younger brother” of the SSL protocol. Much like the secure sockets layer, it’s a secure encryption protocol that enables businesses to protect their most secure assets in transit. But the way it does this differs from SSL on a technical level that is too “in-the-weeds” to go into here.   

So, for all intents and purposes, TLS is what puts the “s” at the end of https:// of your website’s URL. That single letter transforms the insecure hypertext transfer protocol into the hypertext transfer protocol secure version we all know and love.  

Why TLS Security Matters 

Without the secure TLS protocol in place, data would be transmitted in plain text (readable) format. This means that your passwords, banking information, customers’ personally identifiable information, and a slew of other secrets would be vulnerable to manipulation or theft via man-in-the-middle (MitM) interception attacks.   

What the TLS Protocol Does 

In a nutshell, transport layer security enables a server to authenticate to a connecting party in order to establish an authenticated, secure connection.  

TLS = SSL Security on Steroids 

Things can get a bit tricky with terms like “SSL” and “TLS” since people across the industry often use them interchangeably.  

TLS replaced SSL as the standard security protocol when SSL was deprecated. But why get rid of SSL at all? The answer lies in the protocol’s notable drawbacks, which include a complex handshake and its reliance on outdated (insecure) cryptographic algorithms. TLS: 

• secures your data in transit using a mix of public and private key encryption. 

• streamlines the traditional SSL “handshake” process (i.e., a process wherein two parties exchange essential information, including an SSL/TLS certificate, supported key agreement and cipher information, etc.). 

• uses more specific, structured, and encrypted alerts than its predecessor. 

• relies on hash-based message authentication codes (HMACs) to authenticate your data.  

• supports stronger cryptographic algorithms for confidentiality (encryption) and data integrity protection (hashing). 

So, why not just update the SSL protocol to make it better? Its creators did — although SSL version 2.0 wasn’t technically the first version of the protocol, it was the first to be publicly released. And that only lasted until SSL 3.0 came about. But even with the updates and improvements, it still wasn’t secure enough. So, industry leaders instead launched the first iteration of the TLS protocol.  

An Overview of the TLS Protocol’s 4 Versions 

Like SSL, TLS has had multiple versions of the protocol roll out over its 25+ year history: 

• TLS 1.0 (deprecated): Launched in early 1999, this first version of TLS didn’t stray far from its root, as it was built with SSL 3.0 as its bedrock. (It was viewed as akin to “SSL version 3.1” despite the fact that SSL 3.0 and TLS 1.0 weren’t interoperable.) 

• TLS 1.1 (deprecated): This updated version of the TLS protocol, which was standardized in 2006, made tweaks that addressed some of the vulnerabilities discovered in version 1.0.  

• TLS 1.2 (still in use): Two years later, TLS 1.2 made its debut. It remains the most popular version of the TLS protocol, even now.  

• TLS 1.3 (the current standard): Although it’s not as widely adopted as TLS 1.2, this latest version of the protocol is the most secure, largely in part due to its mandate for perfect forward secrecy (PFS).  

How TLS Works: How the TLS Protocol Makes Internet Security Possible 

The way that TLS works depends on which version of the protocol you’re using. From an overarching perspective, transport layer security works in much of the same way that SSL did during its tenure, using many of the same processes and technologies:  

• Enables use of the SSL/TLS handshake to exchange key- and supported algorithm-related information  

• Uses a mix of asymmetric and symmetric cryptography to protect the information needed to establish a secure shared session and to secure the session itself   

• Employs message authentication codes that use hashing to provide another layer of security 

However, there’s a big difference in terms of how TLS 1.0 and 1.1 work compared to TLS 1.2, and an even bigger difference in contrast to TLS 1.3. For example, here’s a quick comparison of the TLS 1.2 and 1.3 handshakes.

 TLS 1.2 Handshake

TLS 1.3 Handshake

Now that we know what the transport layer security protocol is and why it matters, are you ready to start using it to secure your website? Check out our list of relevant resources and learn how to get an SSL (TLS) certificate for your website.