TLS is a cryptographic protocol that provides secure communication over computer networks. In web browsers, it enables HTTPS, ensuring data confidentiality, integrity, and authentication between clients and servers. Modern web applications should use the latest TLS version and proper cipher configurations to maintain security.
Transport Layer Security is the cryptographic protocol that secures data as it travels between two endpoints on a network. It is the successor to SSL, and it underpins HTTPS as well as secure email, VPNs, and many other protocols. A TLS session begins with a handshake: the client and server agree on a protocol version and cipher suite, the server (and optionally the client) authenticates with an X.509 certificate, and both sides derive fresh session keys, typically using an ephemeral key exchange so past traffic stays safe even if a key later leaks. After the handshake, application data is encrypted and each record carries an authentication tag that detects any tampering in transit.
TLS delivers the three properties web traffic depends on: confidentiality, so data cannot be read on the wire; integrity, so it cannot be silently altered; and authentication, so the client knows which server it reached. Without it, credentials, session tokens, and personal data cross the network in the clear, and an active attacker can rewrite responses. The protocol version and cipher choices matter a great deal: obsolete versions such as SSL 3.0, TLS 1.0, and TLS 1.1 have known weaknesses, while TLS 1.2 and TLS 1.3 with forward-secret ciphers are the current baseline. TLS 1.3 also trims the handshake and drops legacy, insecure options.
Support only TLS 1.2 and 1.3, disable weak ciphers and renegotiation, prefer forward secrecy, and keep certificates valid and automatically renewed. Pair TLS with HSTS so browsers never fall back to plaintext, and watch for mixed content that quietly bypasses the encrypted channel. TLS is a neutral web-platform primitive: it protects the pipe, not the payload. A malicious third-party script arrives over a perfectly valid TLS connection, so client-side monitoring of what code actually executes is a distinct concern that transport encryption cannot address on its own.
TLS is the modern successor to SSL. SSL 2.0 and 3.0 are obsolete and insecure, and the term SSL survives mostly out of habit, in phrases like SSL certificate. When people say SSL today they almost always mean TLS, which is what browsers and servers actually negotiate.
No. TLS secures the connection to a server and confirms its identity, but it makes no judgement about the server's intentions or the scripts it serves. Malware and skimmers are delivered over valid TLS just as reliably as legitimate content. Content-level defences are needed for that.
We answer client-side security questions every day. Bring yours.