TLS
Definition
TLS is a protocol that wraps an ordinary network connection in encryption and identity checking. It sits between TCP and whatever is being sent, so it protects HTTP, SMTP, IMAP and much else — the web is simply its most visible user. Two versions matter now: TLS 1.2, still widely supported, and TLS 1.3, which is faster and drops a pile of old, weak options. Everything before that, meaning SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1, is deprecated and disabled in current browsers. Three things happen on a protected connection: the traffic is encrypted, an SSL certificate proves the server owns the hostname, and tampering in transit is detected rather than silently passed along. Note the split — TLS is the protocol, the certificate is the credential it presents, and HTTPS is the name for HTTP carried this way.
Why It Matters
Unprotected traffic is readable and editable by anything on the path: the cafe wifi, the office proxy, a compromised router in between. Injected adverts and rewritten download links were routine on plain HTTP connections, and a visitor downloading an installer had no way to know it was the file you published. Speed moves in the opposite direction to what people expect: TLS 1.3 completes its handshake in one round trip rather than two, so on a 100 millisecond link it saves roughly 100 milliseconds on every new connection. Modern protocol features are gated behind it as well — HTTP/2 and HTTP/3 are, in practice, only available on protected connections.
How It Works
The client opens a connection and sends a hello listing the protocol versions and cipher suites it supports, plus the hostname it wants via Server Name Indication, which is how one IP address can serve many sites. The server picks a version and a cipher, returns its certificate chain, and both sides run a key exchange that produces a shared secret neither could have derived alone. The client verifies the chain up to a trusted root, checks the dates and confirms the name matches. Everything after that is encrypted with a symmetric cipher such as AES-GCM or ChaCha20-Poly1305, cheap enough that the cost is negligible on any hardware made this decade. Session resumption lets a returning client skip most of the handshake, and forward secrecy means recording the traffic today and stealing the private key next year still does not decrypt it.
Real-World Example
A researcher uploads a 12 MB dataset to 99helpers and shares it at harlow-data.99helpers.site with a mailing list of two hundred people. Each download travels over a protected connection, so a reader on hotel wifi gets the bytes as published, not a version something in the middle decided to modify. The researcher configured nothing: the protocol version, the cipher suite and the certificate are handled by the platform and kept current as old ciphers are retired. What used to be a server-tuning exercise is now simply the default.
Common Mistakes
- ✕Saying SSL when you mean TLS and then acting on it — chasing an SSL setting in a server config that has only supported TLS for a decade wastes an afternoon
- ✕Leaving TLS 1.0 and 1.1 enabled for the sake of ancient clients — modern browsers refuse them anyway, so the only thing still reaching you over them is scanners
- ✕Believing encryption vouches for the site's honesty — a phishing page can hold a perfectly valid certificate, since the protocol proves the name, not the intent
- ✕Worrying about handshake cost on static files — the expensive part happens once per connection, and connection reuse amortises it across every asset on the page
Related Terms
SSL Certificate
A small signed file that proves a server is genuinely the one answering for a given hostname, so a browser will open an encrypted connection to it. Everyone calls it an SSL certificate, though the protocol it is used with has been called TLS for years.
HTTPS
HTTP carried inside an encrypted TLS connection, shown in the browser as an https:// address. It is the same web protocol as before, with the traffic protected and the server's identity checked first.
HTTPS Redirect
A rule that answers any request arriving on plain HTTP with an instruction to fetch the same address over an encrypted connection instead. It makes the secure version the only one visitors actually see.
HTTP/2
HTTP/2 is the second major version of the web's request protocol, standardised in 2015. It keeps the same URLs, methods, headers and status codes as HTTP/1.1, but changes how they travel: many requests share one connection instead of queueing behind each other.
Web Server
The software that listens for HTTP requests and answers them with files or generated responses. Nginx, Apache and Caddy are web servers; something like them sits behind every address you have ever opened.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →