HTTPS & TLS
HTTPS encrypts traffic between clients and servers using TLS (Transport Layer Security), protecting it from interception and tampering. It's no longer optional: browsers flag plain HTTP, and features like HTTP/2, service workers, and geolocation require a secure context.
Most TLS work is configuration, not cryptography — choosing modern protocol versions, automating certificates, and enforcing HTTPS so it can't be bypassed.
TL;DR
- Use HTTPS everywhere in production, including internal services.
- Require TLS 1.2+ and disable TLS 1.0/1.1.
- Automate certificates and renewal (Let's Encrypt / ACME).
- Enable HSTS so browsers refuse to downgrade to HTTP.
- Redirect all HTTP traffic to HTTPS.
Quick Example
A minimal modern Nginx setup: redirect HTTP to HTTPS and serve over TLS 1.2/1.3 only.
Core Concepts
The TLS handshake
- Client sends its supported cipher suites and TLS versions.
- Server picks a cipher and presents its certificate.
- Client verifies the certificate against trusted CAs.
- Both sides derive shared session keys.
- Encrypted communication begins.
TLS 1.3 streamlines this to a single round trip, making connections faster and more secure.
TLS versions
Certificate types
Best Practices
Automate certificates with ACME
Issue and renew certificates automatically so they never expire by surprise:
Enable HSTS
Tell browsers to only ever use HTTPS for your domain, preventing SSL-stripping:
⚠️
preloadis a commitment. Submitting to the HSTS preload list bakes HTTPS-only into browsers and is slow to undo. Only addpreloadonce every subdomain is reliably HTTPS.
Staple OCSP and use modern ciphers
Generate a vetted configuration with the Mozilla SSL Configuration Generator rather than hand-picking cipher suites.
Common Mistakes
Allowing legacy TLS
Serving mixed content
Forgetting renewal
Manually issued certificates expire and cause outages. Always automate renewal and alert on approaching expiry.
Testing
For a full grade, run the domain through SSL Labs.
FAQ
What's the difference between SSL and TLS?
TLS is the modern successor to SSL; "SSL" persists only as a colloquial name (and in "SSL certificate"). All current secure connections use TLS — SSL 2.0/3.0 are broken and disabled.
Do internal services really need HTTPS?
Yes. Internal networks aren't inherently trusted, and encrypting internal traffic limits lateral movement after a breach. mTLS (mutual TLS) is common for service-to-service auth.
TLS 1.2 or 1.3?
Prefer 1.3 — it's faster and drops legacy cryptography — but keep 1.2 enabled for older clients. Disable everything below 1.2.
Are free certificates okay for production?
Absolutely. Let's Encrypt issues DV certificates trusted by all major browsers. Paid OV/EV certs add organizational vetting, not stronger encryption.
Related Topics
- Encryption & Cryptography — The primitives TLS is built on
- Security Headers — HSTS and related response headers
- API Security — Why transport security comes first
- Application Security — Where HTTPS fits in defense in depth