TLS (HTTPS)
TLS · SSL · HTTPS · Transport Layer Security · TLS 1.3 · TLS 1.2 · browser padlock
A protocol that encrypts and authenticates exchanges between two machines, such as your browser and an HTTPS website, so that data cannot be read or altered in transit.
In practice
TLS first checks the server’s identity using its certificate, then negotiates session keys that encrypt the whole exchange. The version to prefer is TLS 1.3 (2018), faster and stripped of fragile mechanisms; TLS 1.2 remains acceptable if properly configured (ECDHE key exchange, AES-GCM or ChaCha20-Poly1305 encryption). SSL 2.0 and 3.0, TLS 1.0 and TLS 1.1 are obsolete, the IETF having formally deprecated the last two in 2021: they must be disabled. Bear in mind that TLS protects the transport, not the content: a phishing site can perfectly well display a padlock.
Fictional case: a surface scan reveals that an SME’s old supplier portal still accepts TLS 1.0 and weak cipher suites. Disabling those versions on the server takes ten minutes and blocks no real user.
How to protect yourself
- Enable TLS 1.3, keep TLS 1.2 with strong cipher suites and disable everything else.
- Renew certificates automatically (ACME protocol).
- Add the HSTS header to rule out any fallback to HTTP.
