TLS in depth

Why it matters

Almost all traffic is encrypted now, and TLS is the reason a user can trust that they are talking to your bank and that nobody in between read or altered the conversation. It is also a reliable source of outages: an expired certificate takes down an API as completely as a crashed server, a missing intermediate certificate breaks some clients but not others, and handshake cost shapes how you design connection reuse and edge termination.

The idea

TLS (Transport Layer Security) runs on top of a reliable transport and gives the application three guarantees: confidentiality (only the endpoints can read the data), integrity (any tampering is detected), and authentication (the client knows it is talking to the server that owns the name it asked for, and optionally the server knows the client). It achieves this by agreeing fresh symmetric keys with an asymmetric key exchange, and proving identity with certificates.

The TLS 1.3 handshake

1. 1

   ClientHello

   The client lists supported versions and cipher suites, sends an ephemeral Diffie-Hellman key share (usually X25519), and names the host it wants via SNI.
2. 2

   ServerHello

   The server picks the parameters and sends its own key share. Both sides can now compute a shared secret that was never sent over the wire, and everything after this point is encrypted.
3. 3

   Certificate and proof

   The server sends its certificate chain and signs the handshake transcript with the certificate's private key, proving it holds that key.
4. 4

   Finished

   Both sides confirm the transcript with a MAC; the client verifies the certificate chain and hostname and can send its request in the same flight.

Because the key shares are ephemeral and discarded, recording the traffic today and stealing the server's private key later does not reveal past sessions: forward secrecy, mandatory in TLS 1.3.

Certificates and the chain of trust

A certificate binds a public key to one or more names (in its Subject Alternative Name list) and is signed by a certificate authority. Clients trust a set of root CAs shipped with the operating system or browser. Servers present their leaf certificate plus any intermediate certificates that link it to a root; the client builds the chain and checks each signature, the validity dates, the hostname and revocation status.

SNI, termination and resumption

SNI puts the requested hostname in the ClientHello so one IP can host many certificates; it is visible to observers unless Encrypted Client Hello is used. Most systems terminate TLS at a load balancer or CDN and use separate TLS (or plain HTTP inside a trusted network) to backends. Session resumption lets a returning client skip the certificate and key exchange work using a ticket from a previous session, cutting CPU and latency. 0-RTT goes further and lets the client send data with its very first flight on resumption, at the risk that an attacker replays that data, so it is only safe for idempotent requests.

Mutual TLS between services

In mTLS the client also presents a certificate, and the server verifies it, so both sides are authenticated cryptographically. Service meshes issue short-lived certificates to every workload automatically and rotate them hourly or daily, giving service-to-service identity and encryption without application code. The operational burden moves to the certificate authority and rotation machinery.

Cost

A full handshake costs one round trip (on top of TCP's) and some milliseconds of CPU for the asymmetric operations on the server; bulk encryption with AES-GCM or ChaCha20 is nearly free on modern hardware. That is why connection reuse, session resumption and edge termination near users matter more than cipher choice.

Trade-offs

TLS buys confidentiality, integrity and authentication for a round trip and modest CPU, which is always worth it. Terminating at the edge simplifies certificate management and enables L7 features, at the cost of decrypted traffic inside your network unless you re-encrypt. mTLS gives strong service identity at the cost of running a CA and rotation reliably. 0-RTT trades replay safety for latency and must be limited to safe requests.

In an interview

Cover the handshake cost and the operations: "TLS 1.3 terminates at the CDN and the load balancer, with re-encryption to services; certificates come from ACME with automatic renewal and we alert 21 days before expiry; the full chain is served. Between services the mesh provides mTLS with day-long certificates. Resumption is on; 0-RTT only for GETs." Mentioning expiry monitoring and full chains shows you have been paged for them.