TLS: Encrypting the Connection

Nearly every connection a browser or API client makes today runs inside TLS, the protocol that turns HTTP into HTTPS. It hides what is sent, detects tampering and proves which server answered, and when one of those checks fails, the error it produces is one of the most common a developer has to read.

First comes what TLS guarantees and where it sits between TCP and the application. Then the TLS 1.3 handshake, certificates and the chain of trust that makes a browser believe a server, with an example of reading a real chain. After that come SNI, the field that names the site before encryption begins, the three certificate errors that look alike, and mutual TLS, where the client proves its identity too.

The mathematics of the ciphers, and running a certificate authority, are outside it.

By the end you can say what TLS hides and what it leaves visible, order its handshake, follow a chain to a trusted root, diagnose a certificate error and tell TLS from mutual TLS.