====== TLS / SSL ======

**TLS (Transport Layer Security)** is the protocol that secures communication over the Internet.

It provides:

  * Encryption
  * Authentication
  * Data integrity

TLS is used by HTTPS, secure email protocols, VPNs, and many other Internet services.

-----

===== SSL vs TLS =====

Originally, secure web communication used **SSL (Secure Sockets Layer)**.

Over time, SSL was replaced by the more secure **TLS** protocol.

Today:

  * SSL 2.0 — Obsolete
  * SSL 3.0 — Obsolete
  * TLS 1.0 — Deprecated
  * TLS 1.1 — Deprecated
  * TLS 1.2 — Widely used
  * TLS 1.3 — Current recommendation

Although the protocol is now TLS, people still commonly say:

  * SSL Certificate
  * SSL Encryption

In most cases, they actually mean **TLS**.

-----

===== Why TLS Is Important =====

Without TLS, information is sent as plain text.

For example:

<code>
Username

alice

Password

mypassword123
</code>

Anyone able to intercept the traffic may be able to read it.

With TLS:

<code>
Encrypted Data
</code>

Only the browser and the server can decrypt the communication.

-----

===== What Does TLS Protect? =====

TLS provides three essential security services.

===== Encryption =====

Protects data from being read by others.

-----

===== Authentication =====

Verifies that the client is communicating with the intended server.

This is done using a **digital certificate**.

-----

===== Integrity =====

Ensures that transmitted data has not been modified during transmission.

-----

===== TLS Handshake =====

Before encrypted communication begins, the client and server perform a **TLS Handshake**.

The handshake establishes:

  * Supported TLS version
  * Encryption algorithms
  * Session keys
  * Server identity

Simplified process:

<code>
Browser
      │
Client Hello
      ▼
Server

Certificate

Server Hello
      ▲
      │
Key Exchange

Secure Connection Established
</code>

After the handshake, all application data is encrypted.

-----

===== Digital Certificates =====

Every HTTPS website presents a digital certificate.

A certificate typically contains:

  * Domain name
  * Public key
  * Certificate Authority (CA)
  * Expiration date
  * Digital signature

Browsers verify the certificate before trusting the website.

-----

===== Certificate Authorities (CA) =====

Certificates are normally issued by trusted organizations called **Certificate Authorities (CAs)**.

Examples include:

  * Let's Encrypt
  * DigiCert
  * Sectigo
  * GlobalSign

Browsers contain a list of trusted CAs.

-----

===== Self-Signed Certificates =====

A certificate may also be created by the server itself.

This is called a **self-signed certificate**.

Self-signed certificates provide encryption, but browsers cannot verify the server's identity.

As a result, browsers usually display a warning.

-----

===== TLS Versions =====

Modern websites should support:

<code>
TLS 1.2

or

TLS 1.3
</code>

Older versions are no longer considered secure.

Many browsers no longer allow connections using SSL or early TLS versions.

-----

===== Common Uses =====

TLS is used by many Internet protocols.

^ Protocol ^ Typical Secure Version ^
| HTTP | HTTPS |
| SMTP | SMTPS / STARTTLS |
| POP3 | POP3S |
| IMAP | IMAPS |
| FTP | FTPS |
| LDAP | LDAPS |

-----

===== TLS and Telenegar =====

Several Telenegar services examine TLS configuration.

**Site Check** can verify:

  * HTTPS availability
  * Supported TLS versions
  * Certificate validity
  * Certificate expiration
  * Certificate issuer
  * Hostname matching

These checks help identify common security issues before they affect website visitors.

-----

===== Common Certificate Errors =====

Examples include:

  * Expired certificate
  * Self-signed certificate
  * Wrong hostname
  * Untrusted Certificate Authority
  * Incomplete certificate chain

Browsers typically display security warnings when these problems occur.

-----

===== Common Misconceptions =====

  * **SSL and TLS are different technologies.**
    * TLS is the modern successor to SSL.

  * **HTTPS means a website is trustworthy.**
    * False. HTTPS only secures the communication.

  * **Encryption alone guarantees security.**
    * False. Server configuration, software updates, and application security are also important.

-----

===== Related Topics =====

  * [[networking:protocols:http-https|HTTP vs HTTPS]]
  * [[security:security-headers|Security Headers]]
  * [[tools:sitecheck|Site Check]]
  * [[email:spf|SPF Records]]
  * [[email:dkim|DKIM Records]]

-----

{{tag>tls ssl https certificates encryption security}}