tls

Transport Layer Security (TLS)

What it is

Transport Layer Security (TLS) is the security protocol behind most HTTPS connections. It helps a browser or application verify the server it contacted and encrypts data while it travels across the network. “SSL” is the older name people still use informally, but modern secure connections use TLS.

Why it exists

Without TLS, someone who can observe a network connection may be able to read or alter sensitive information such as sign-in credentials, order data, or payment details. TLS gives clients a certificate to validate the server name and establishes encryption for the connection.

Key ideas

• HTTPS means HTTP carried over TLS. It protects data in transit; it does not make the application, its identity permissions, or its stored data automatically safe.
• A certificate proves control of a domain name and contains a public key. The server protects the matching private key. A certificate can expire, be misconfigured, or name the wrong hostname.
• DNS directs a friendly name such as orders.northwind.example to an endpoint. TLS then verifies that the endpoint presents a certificate valid for that name. DNS and TLS solve related but different problems.
• Set a current minimum TLS version supported by the service and clients. Older protocol versions can have security weaknesses; changing a minimum version can also break old clients.

Northwind example

Northwind publishes its ordering site at orders.northwind.example. DNS directs the name to the public App Service endpoint. App Service presents a certificate for that hostname and enforces HTTPS, so a shopper’s browser can establish an encrypted connection. If Northwind forgets to renew a customer-managed certificate, the site can remain reachable but browsers will warn users and may refuse the connection.

Common confusion

• TLS encrypts traffic in transit; it does not encrypt a database at rest or authorize a caller to read it.
• A padlock in the browser does not prove the website is trustworthy or free of application vulnerabilities. It proves the browser established TLS with the presented identity.
• A certificate is not a secret to share. Its private key is sensitive and should be protected, for example through a suitable certificate-management process or Key Vault.

Related

azure-dns · app-service-tls-custom-dns · key-vault · application-gateway · northwind-traders-case-study

Sources and re-audit

• Microsoft Learn — Add and manage TLS/SSL certificates in Azure App Service, checked 2026-09-16.