Transport Layer Security (TLS) is the standard for securing communication across networks you cannot trust. It encrypts exchanged data, detects tampering, and verifies the server’s identity, making it the foundation of HTTPS and many application-security standards. section 3.3 section 10.1.2
TLS assumes that messages may cross unknown routers, compromised Wi-Fi networks, spyware, or other hostile intermediaries. During the handshake, the parties negotiate supported encryption methods, exchange certificates, and establish a shared secret without transmitting that secret directly. Certificates connect a server identity to a trusted certificate authority and hostname. section 10.1 section 10.1.1 section 10.2.3
TLS addresses three practical network threats:
- Eavesdropping: encryption keeps intercepted messages unreadable. section 10.2.1
- Tampering: integrity checks reject messages changed in transit. section 10.2.2
- Impersonation: certificate validation helps browsers distinguish the real site from a fake. section 10.2.3
TLS, mTLS, and certificate validation
A normal browser connection authenticates the server, while the client remains unauthenticated at the connection layer. Mutual TLS (mTLS) extends this pattern: both client and server present trusted certificates before communicating. This makes mTLS useful for service-to-service communication, secure APIs, and microservices that must reject unknown clients. For local development, a personal certificate authority avoids the validation errors caused by ad hoc self-signed certificates; disabling validation instead can allow insecure code to reach production. section 10.1.2 section 9.2 section 10.5
Table 10.1 A comparison between TLS and mTLS
|
TLS
|
mTLS
|
|
|---|---|---|
|
Encrypts data
|
Yes
|
Yes
|
|
Server proves identity
|
Yes
|
Yes
|
|
Client proves identity
|
No
|
Yes
|
|
Common uses
|
Web browsing
|
Service-to-service communication and secure APIs
|
|
Client certificate required
|
No
|
Yes
|
Compare ordinary TLS and mTLS by encryption, identity verification, client-certificate requirements, and common deployment contexts. section 10.1.2
