Transport Layer Security (TLS)

TLS is a cryptographic protocol used to secure communication over a network. It is most commonly used in HTTPS, where it encrypts data between a client (browser) and a server.

Core idea

TLS ensures that data is encrypted, authenticated, and tamper-proof during transmission, by providing the following features:

• Encryption
  • Prevents eavesdropping (data cannot be read in transit)
• Authentication
  • Verifies the identity of the server using certificates
• Integrity
  • Ensures data is not modified during transmission

The primary application is to ensure that the sender and the receiver can securely verify each other’s identities and establish a shared encryption method for communication.

TLS Authentication Process

TLS authentication is the process where a client verifies the identity of a server and establishes a secure encrypted channel before any real data (HTTP requests) is exchanged. This process is called TLS Handshake:

Client (Browser)                          Server
    │                                       │
    │──── 1. Client Hello ──────►│
    │   (supported TLS versions, ciphers)   │
    │                                       │
    │◄─── 2. Server Hello ───────│
    │       (chosen cipher suite)           │
    │                                       │
    │◄───  3. Certificate ───────│
    │    (server public key + identity)     │
    │                                       │
    │── 4. Certificate Verification ──►│
    │     (client checks CA trust chain)    │
    │                                       │
    │──── 5. Key Exchange ──────►│
    │    (securely agree on session key)    │
    │                                       │
    │─ 6. Finished (encrypted channel) ─►│
    │◄─ 7. Finished (encrypted channel) ─│

1. Client Hello: client sends:
   • TLS version supported
   • Cipher suites (encryption methods)
   • Random number (used later for key generation)
2. Server Hello: Server responds with:
   • Selected TLS version
   • Selected cipher suite
   • Server random value
3. Certificate: server sends a TLS certificate, which contains:
   • Domain name (e.g. google.com)
   • Public key
   • Signature from a Certificate Authority (CA)
4. Certificate validation (authentication step): client verifies:
   • Is the certificate signed by a trusted CA?
   • Does the domain match the certificate?
   • Is the certificate expired or revoked?
   • If any check fails → browser shows security warning
5. Key exchange (secure secret creation) Client and server establish a shared secret key (not sent directly over the network) using methods like:
   • RSA (older)
   • ECDHE (modern, most common)
6. Session key generation: both sides derive the same symmetric encryption key (used for encode and decode sent data).
7. Secure communication starts

Acquiring Signed Certificate from CA

1. AWS Certificate Manager (ACM)
2. Cloudflare
3. Let’s Encrypt (free option)