TLS

TLS (Transport Layer Security) is the standard protocol for securing TCP-based communication. It is the successor to SSL and provides three properties on top of an otherwise plain TCP connection: confidentiality through symmetric encryption, server (and optionally client) authentication through X.509 certificates, and integrity through authenticated ciphers. The same protocol underpins HTTPS, SMTPS, IMAPS, modern SMTP with STARTTLS, and many non-web protocols.

A TLS session begins with a handshake. The client sends its supported versions and ciphers along with the target hostname in the SNI extension; the server selects a cipher suite, returns its certificate chain, and the two sides agree on symmetric session keys (in TLS 1.3 this completes in a single round trip). The client validates the certificate against its trusted root CAs and checks that the domain name matches the certificate's subject or SAN. SNI is what allows many hostnames to share one IP and one server: the server uses the SNI value to pick the right certificate before the handshake completes. TLS 1.2 and 1.3 are the versions in active use today; 1.0 and 1.1 are deprecated and disabled in modern stacks.