TLS

What is TLS?

TLS (Transport Layer Security) is a cryptographic protocol that provides secure communication over computer networks. It’s the successor to SSL and is used to encrypt data transmitted between web browsers and servers (HTTPS), email clients and servers, and many other applications.

TLS Versions

• TLS 1.0 (1999) - Deprecated 2020
• TLS 1.1 (2006) - Deprecated 2020
• TLS 1.2 (2008) - Widely supported
• TLS 1.3 (2018) - Current standard

TLS 1.3 Improvements

Faster Handshake

TLS 1.2: 2 round trips
TLS 1.3: 1 round trip (0-RTT possible)

Stronger Security

• Removed weak cipher suites
• Forward secrecy mandatory
• Encrypted handshake messages

Simplified Protocol

• Fewer cipher suites
• Cleaner negotiation
• Better performance

TLS Handshake (1.3)

Client → Server: ClientHello
  - Supported versions
  - Key shares
  - Cipher suites

Server → Client: ServerHello
  - Selected version (TLS 1.3)
  - Key share
  - Certificate (encrypted)
  - Finished

Client → Server: Finished

[Encrypted application data]

Cipher Suites

TLS 1.3 (Simplified)

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256

TLS 1.2 (Complex)

ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256

Configuring TLS

Nginx

server {
    listen 443 ssl http2;
    
    # TLS versions
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # TLS 1.3 ciphers (preferred)
    ssl_ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384;
    
    # Certificates
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
}

Node.js

import https from 'https';
import fs from 'fs';

const server = https.createServer({
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('cert.pem'),
  minVersion: 'TLSv1.3',
  maxVersion: 'TLSv1.3'
}, (req, res) => {
  res.writeHead(200);
  res.end('TLS 1.3 connection');
});

server.listen(443);

Testing TLS

# Check TLS version
openssl s_client -connect example.com:443 -tls1_3

# Test cipher suites
nmap --script ssl-enum-ciphers -p 443 example.com

# Online tools
# - SSL Labs (ssllabs.com/ssltest)
# - testssl.sh

TLS Best Practices

1. Use TLS 1.2 minimum, prefer 1.3
2. Disable SSLv2, SSLv3, TLS 1.0, TLS 1.1
3. Use strong cipher suites
4. Enable Forward Secrecy
5. Implement HSTS
6. Regular certificate rotation

TLS with CorsProxy

// CorsProxy uses TLS 1.2/1.3 automatically
const response = await fetch(
  'https://corsproxy.io/?url=https://api.example.com',
  {
    headers: {
      'x-cors-api-key': process.env.CORS_API_KEY
    }
  }
);

// Your app ←[TLS 1.3]→ CorsProxy ←[TLS 1.2/1.3]→ Destination
// No configuration needed
// Modern ciphers only
// Perfect forward secrecy

Common TLS Issues

Version Mismatch

Client: TLS 1.3 only
Server: TLS 1.2 only
Result: Connection failed

Certificate Errors

• Expired certificate
• Self-signed certificate
• Hostname mismatch
• Untrusted CA

Cipher Suite Incompatibility

Client: Supports only TLS_AES_128_GCM_SHA256
Server: Offers only TLS_CHACHA20_POLY1305_SHA256
Result: Handshake failure

Learn More

• SSL protocol history
• HTTPS implementation
• SSL certificates
• Encryption fundamentals