# What is Transport Layer Security (TLS)?

> Transport Layer Security is the cryptographic protocol that authenticates endpoints — typically the server — and protects the confidentiality and integrity of data in transit, forming the security layer behind HTTPS and many other protocols.

- Canonical URL: https://yellowcube.eu/glossary/transport-layer-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A TLS handshake negotiates protocol version and cipher suite, authenticates the server with a certificate chain, and establishes shared session keys. Current practice requires TLS 1.2 or 1.3; SSL and early TLS versions are deprecated and prohibited by modern standards and regulation.

TLS protects the channel between two endpoints, nothing more. It does not protect data before it enters the channel or after it leaves; it does not authenticate that the destination is the service the user intended to reach beyond what the certificate asserts, and it creates inspection and visibility trade-offs that networks must design around deliberately.

### Key points

- **Handshake and trust:** Version and cipher negotiation, server authentication via certificate chain, optional client authentication, and session-key establishment authenticated by the endpoint’s private key.
- **Deployment requirements:** Supported versions only, strong cipher suites, valid certificate chains with managed renewal, correct server-name indication and virtual-host handling, and secure renegotiation and resumption behavior.
- **Visibility trade-offs:** Encryption protects content from intermediaries — including defenders — so inspection must be an explicit, governed design choice rather than an assumed capability.
- **Important limitation:** TLS authenticates and encrypts a channel between endpoints; it cannot vouch for what happens at either end. Compromised endpoints, misissued or mistrusted certificates, downgrade paths, and terminated-then-reencrypted traffic all erode the guarantee.

### Related terms

[Public key infrastructure (PKI)](<https://yellowcube.eu/glossary/public-key-infrastructure/>) · [Digital certificate](<https://yellowcube.eu/glossary/digital-certificate/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [SSL/TLS VPN](<https://yellowcube.eu/glossary/ssl-tls-vpn/>) · [Transport Layer Security (TLS) inspection](<https://yellowcube.eu/glossary/transport-layer-security-inspection/>)

### Sources

[IETF RFC 8446: TLS 1.3](https://datatracker.ietf.org/doc/html/rfc8446) · [NIST SP 800-52 Rev. 2: Guidelines for the Selection, Configuration, and Use of Transport Layer Security Implementations](https://csrc.nist.gov/pubs/sp/800/52/r2/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.