What is TLS?

TLS (Transport Layer Security) is the protocol that encrypts and authenticates network connections: the "S" in HTTPS, and the security layer under many VPNs, mail servers and management protocols.

A TLS connection starts with a handshake. The two sides agree on cryptographic algorithms, the server (and optionally the client) presents a certificate signed by a certificate authority the other side trusts, and they derive fresh keys that only they know. After that, everything sent is encrypted, and any tampering is detected. The current version, TLS 1.3, is faster and removes old, weaker options; TLS replaced the older SSL, which is why some tools still say "SSL".

Most people meet TLS through web browsers, but it's everywhere in networking: OpenVPN uses a TLS handshake to authenticate users and set up the keys for its tunnel, many routers serve their management interfaces over it, and RPKI repositories are fetched over HTTPS. When TLS fails, the error is almost always about certificates: an expired or revoked certificate, a name that doesn't match, or a CA the other side doesn't trust. The OpenVPN on Debian lesson shows TLS handshakes succeeding and failing, with the real log messages.