What Is TLS and How Does It Work?

Originally published: 2025-10-29

Technical update: 22 October 2026. TLS protects confidentiality and integrity between communicating endpoints. HTTPS uses TLS to protect HTTP traffic. TLS alone does not eliminate application vulnerabilities or malware on an endpoint.

Are SSL and TLS the same?

SSL is the older protocol family. Although certificates are often called “SSL certificates”, current connections should use TLS. RFC 8996 deprecates TLS 1.0 and 1.1. Assess TLS 1.2 and 1.3 configuration against supported clients rather than casually weakening protection for a legacy system.

How is a connection established?

The handshake negotiates appropriate parameters. In common web use, certificates and a trust chain authenticate the server. Client-certificate authentication is a separate configuration; HTTPS does not automatically authenticate every user with a certificate. Session keys protect application data. The TLS 1.3 specification defines the protocol details.

Certificate checklist

• Confirm that the certificate covers the hostname.
• Check validity, trust chain and successful automatic renewal.
• Investigate incorrect clocks or missing intermediate certificates.
• Do not treat bypassing browser warnings or disabling certificate verification as a permanent fix.

Behind CDNs and reverse proxies

An encrypted browser-to-CDN connection does not prove that the CDN-to-origin connection is protected in the same way. Check each hop and its certificate-validation policy separately, and document where TLS terminates. The MDN TLS guide explains the scope of transport protection.

Choosing hosting or a server

For web hosting or WordPress hosting, ask about certificate installation, renewal and custom-domain scope. On a cloud server you administer, assign responsibility for the web server, reverse proxy and application configuration. A certificate alone does not establish application security or uninterrupted service.