DE EN IT

~/glossary / Web & TLS

TLS

TLS (Transport Layer Security) is the protocol that encrypts connections and proves the server's identity with certificates; it replaced SSL.

daniele@mikweb: ~/glossary — man tls

During the TLS handshake client and server agree on version and ciphers, the server presents its certificate, and the client checks that it is valid, matches the hostname and chains to a trusted CA. After that, traffic is encrypted.

Current versions are TLS 1.2 and 1.3. SSLv3, TLS 1.0 and 1.1 are considered insecure and disabled in modern clients. The name SSL lives on anyway, for example in nginx's ssl_certificate.

Most TLS errors in daily work are certificate errors: expired, wrong hostname, missing intermediate. Version mismatches with old clients or devices that only speak outdated protocols are less common.

Example

openssl s_client -connect example.com:443 -servername example.com -brief
daniele@mikweb: ~/glossary — ls

Related terms

Certificate chainA certificate chain is the sequence of server certificate, one or more intermediate certificates and the root CA that a client uses to verify authenticity.SNI (Server Name Indication)SNI (Server Name Indication) is a TLS extension where the client names the requested hostname during the handshake, so the server can pick the right certificate.STARTTLSSTARTTLS is a command that upgrades an initially unencrypted connection (SMTP, IMAP, POP3) to TLS.HSTSHSTS (HTTP Strict Transport Security) is a response header that tells browsers to access a site exclusively over HTTPS for a set period of time.

← All terms