This lesson's interactive features are locked, please to keep using them

TLS

TLS, short for Transport Layer Security, protects data while it moves between two network endpoints.

The most common place you'll see TLS is HTTPS – Hypertext Transfer Protocol Secure. The "Secure" part is TLS. If you've used the internet today, you've used TLS, whether you knew it or not.

Without TLS, an attacker who can observe the traffic – on the same Wi-Fi network, at an ISP, or at another network hop – can read login credentials, session cookies, and API responses. They can also tamper with requests and responses. TLS is not optional when sensitive data crosses the network.

Click to play video

What TLS Provides

When HTTP runs over TLS and becomes HTTPS, it gains three core protections:

Confidentiality: Attackers can't read encrypted traffic in transit.
Integrity: Attackers can't modify traffic without detection.
Authentication: Clients can verify the server's identity and confirm that it controls the corresponding private key.

TLS uses several cryptographic tools together. During a certificate-based handshake, digital signatures help authenticate the server. After that, authenticated encryption protects application data from being read or tampered with.

Encryption vs. Digital Signatures

You encrypt a patient's medical records when their contents need to stay secret.
You sign a software update when users need to verify who published it and whether it changed.

A digital signature isn't about keeping the contents of that software secret, it's about proving that:

The software was published by the holder of a particular private key.
The software hasn't been modified since it was signed.

Anyone with the corresponding public key can verify the signature, and verification fails if the software or signature has been tampered with... but remember: a signature doesn't hide the software's contents.