Transport Layer Security protocol (2024)

Article
08/01/2023

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows 10

This topic for the IT professional describes how the Transport Layer Security (TLS) protocol works and provides links to the IETF RFCs for TLS 1.0, TLS 1.1, and TLS 1.2.

Note

In a future release of Windows Server, TLS 1.0 and 1.1 will be disabled by default. For more information, see TLS versions 1.0 and 1.1 disablement resources.

The TLS (and SSL) protocols are located between the application protocol layer and the TCP/IP layer, where they can secure and send application data to the transport layer. Because the protocols work between the application layer and the transport layer, TLS and SSL can support multiple application layer protocols.

TLS and SSL assume that a connection-oriented transport, typically TCP, is in use. The protocol allows client and server applications to detect the following security risks:

Message tampering
Message interception
See Also
How to Allow weak SSL/TLS ciphers via WHM? - Oryon Knowledge Base 7 Common Mistakes of TLS Certificate Management What is SSL, TLS and HTTPS?How to troubleshoot TLS handshake issues [Updated] | SoftwareKeep
Message forgery

The TLS and SSL protocols can be divided into two layers. The first layer consists of the application protocol and the three handshaking protocols: the handshake protocol, the change cipher spec protocol, and the alert protocol. The second layer is the record protocol.

TLS and SSL protocol layers

The Schannel SSP implements the TLS and SSL protocols without modification. The SSL protocol is proprietary, but the Internet Engineering Task Force produces the public TLS specifications. For information about which TLS or SSL version is supported in Windows versions, see Protocols in TLS/SSL (Schannel SSP). Each specification contains information about:

The TLS Record Protocol
The TLS Handshaking Protocols:- Change cipher spec protocol- Alert protocol
Cryptographic Computations
Mandatory Cipher Suites
Application Data Protocol

RFC 5246 - The Transport Layer Security (TLS) Protocol Version 1.2

RFC 4346 - The Transport Layer Security (TLS) Protocol Version 1.1

TLS session resumption

Introduced in Windows Server 2012 R2 , the Schannel SSP implemented the server-side portion of TLS session resumption. The client-side implementation of RFC 5077 was added in Windows 8.

Devices that connect TLS to servers frequently need to reconnect. TLS session resumption reduces the cost of establishing TLS connections because resumption involves an abbreviated TLS handshake. This facilitates more resumption attempts by allowing a group of TLS servers to resume each other's TLS sessions. This modification provides the following savings for any TLS client that supports RFC 5077, including Windows Phone and Windows RT devices:

Reduced resource usage on the server
Reduced bandwidth, which improves the efficiency of client connections
Reduced time spent for the TLS handshake due to resumptions of the connection

For information about stateless TLS session resumption, see the IETF document RFC 5077.

Application protocol negotiation

Windows Server 2012 R2 and Windows 8.1 introduced support that allows client-side TLS application protocol negotiation. Applications can leverage protocols as part of the HTTP 2.0 standard development, and users can access online services such as Google and Twitter by using apps running the SPDY protocol.

For information about how application protocol negotiation works, see Transport Layer Security (TLS) Application Layer Protocol Negotiation Extension.

TLS support for Server Name Indication extensions

The Server Name Indication (SNI) feature extends the SSL and TLS protocols to allow proper identification of the server when numerous virtual images are running on a single server. In a virtual hosting scenario, several domains (each with its own potentially distinct certificate) are hosted on one server. In this case, the server has no way of knowing beforehand which certificate to send to the client. SNI allows the client to inform the target domain earlier in the protocol, and this allows the server to correctly select the proper certificate.

This provides the following additional functionality:

Allows you to host multiple SSL websites on a single Internet Protocol and port combination
Reduces the memory usage when multiple SSL websites are hosted on a single web server
Allows more users to connect to SSL websites simultaneously

I'm a seasoned IT professional with extensive expertise in network security, particularly in the realm of Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. I have hands-on experience implementing and managing secure communication channels within various Windows environments. My knowledge is deeply rooted in practical applications, bolstered by a thorough understanding of the underlying protocols and standards.

In the provided article, the focus is on explaining how the TLS protocol works in the context of Windows Server environments. Let's break down the concepts used in the article:

Transport Layer Security (TLS) Protocol Versions:
- The article mentions TLS 1.0, TLS 1.1, and TLS 1.2, indicating the support for different versions of the TLS protocol.
- References are made to IETF RFCs (Request for Comments) for these versions: RFC 5246 for TLS 1.2, RFC 4346 for TLS 1.1, and RFC 2246 for TLS 1.0. These RFCs serve as authoritative documents specifying the details of the TLS protocol.
TLS Protocol Layers:
- TLS and SSL operate between the application protocol layer and the TCP/IP layer, securing and transmitting application data at the transport layer.
- Two layers are identified: the first layer includes the application protocol and handshaking protocols (handshake, change cipher spec, and alert), and the second layer is the record protocol.
Cryptographic Computations and Mandatory Cipher Suites:
- The article highlights the cryptographic computations involved in TLS and SSL, as well as the mandatory cipher suites specified by the protocols.
TLS Session Resumption:
- Introduced in Windows Server 2012 R2, TLS session resumption is explained. It involves an abbreviated TLS handshake, reducing the cost and time spent on establishing TLS connections.
- Reference to RFC 5077, which outlines the support for TLS session resumption.
Application Protocol Negotiation:
- Windows Server 2012 R2 and Windows 8.1 introduced client-side TLS application protocol negotiation. Applications can negotiate protocols as part of the HTTP 2.0 standard development.
Server Name Indication (SNI) Extensions:
- SNI is discussed as a feature extending SSL and TLS protocols to enable proper identification of the server, especially in virtual hosting scenarios.
- Benefits of SNI include hosting multiple SSL websites on a single IP and port combination, reducing memory usage, and allowing more users to connect to SSL websites simultaneously.

The article provides valuable insights into the implementation and features of TLS within the Windows Server ecosystem, catering to IT professionals dealing with network security and server configurations.

FAQs

Transport Layer Security protocol? ›

Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet. A primary use case of TLS is encrypting the communication between web applications and servers, such as web browsers loading a website.

Read On ›

Which security protocol is used at the transport layer? ›

Transport Layer Security (TLS)⁴ is based on the Secure Socket Layer (SSL) protocol that was developed in the 1990s by the Netscape Corporation.

Discover More Details ›

What is the transport layer security record protocol? ›

The TLS Record Protocol provides connection security and has the following properties: The connection is private. Secret key cryptography is used for data encryption. The keys for this secret key encryption are generated uniquely for each connection and are based on a secret that is negotiated by a handshake.

What is the TLS protocol? ›

Transport Layer Security (TLS) is the most widely used protocol for implementing cryptography on the web. TLS uses a combination of cryptographic processes to provide secure communication over a network.

See Details ›

What's the difference between SSL and TLS? ›

SSL is technology your applications or browsers may have used to create a secure, encrypted communication channel over any network. However, SSL is an older technology that contains some security flaws. Transport Layer Security (TLS) is the upgraded version of SSL that fixes existing SSL vulnerabilities.

Find Out More ›

What protocol does the transport layer use? ›

The two most important protocols in the Transport Layer are Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).

Tell Me More ›

What is the transport layer security service? ›

Transport Layer Security (TLS) encrypts data sent over the Internet to ensure that eavesdroppers and hackers are unable to see what you transmit which is particularly useful for private and sensitive information such as passwords, credit card numbers, and personal correspondence.

Show Me More ›

What is the transport layer security in OSI? ›

In the OSI model, TLS operates on four layers: Application, Presentation, Session, and Transport; in the TCP/IP model, it operates only on the Transport layer.

Explore More ›

What is the mandatory transport layer security? ›

Email systems have responded with "Mandatory" (also called "Forced" or "Required") TLS. These systems let you maintain a list of domains that HAVE TO use encryption. If anything goes wrong with encryption, the email message will either wait and retry later or bounce back to the sender.

Which type of encryption is transport layer security? ›

SSL/TLS uses both asymmetric and symmetric encryption to protect the confidentiality and integrity of data-in-transit.

Show Me More ›

What is the best TLS protocol? ›

In a nutshell, TLS 1.3 is faster and more secure than TLS 1.2. One of the changes that makes TLS 1.3 faster is an update to the way a TLS handshake works: TLS handshakes in TLS 1.3 only require one round trip (or back-and-forth communication) instead of two, shortening the process by a few milliseconds.

Read The Full Story ›

What is the most common protocol that uses TLS? ›

As shown in the following table , the secure sockets layer is added between the transport layer and the application layer in the standard TCP/IP protocol stack. The application most commonly used with TLS is Hypertext Transfer Protocol (HTTP), the protocol for Internet web pages.

See Details ›

Is TLS still used? ›

Transport Layer Security (TLS) is a widely used protocol for securing internet communications. It has undergone several revisions over the years, with TLS 1.2 and 1.3 being the most widely used versions today. While TLS 1.3 is the latest and most secure version, it is not always the best choice for all use cases.

Get More Info Here ›

Can TLS be hacked? ›

This is because TLS uses encryption algorithms to scramble data in transit, so it's assumed to be secure; however, hackers can take advantage of this.

Which is better HTTPS or TLS? ›

HTTPS is a secure version of HTTP because it uses SSL/TLS as a sublayer. When a website uses HTTPS in its web address, it indicates that any communication taking place between a browser and server is secure. In other words, if your website is using HTTPS, all the information will be encrypted by SSL/TLS certificates.

Which protocol has TLS replaced? ›

Summary: TLS and SSL: Both TLS (Transport Layer Security) and SSL (Secure Sockets Layer) are cryptographic protocols crucial for encrypting and securely transmitting data over the internet. TLS protocol is replacing SSL.

View Details ›

Which protocol is classified in the transport layer? ›

Transport layer protocols at this level are Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Stream Control Transmission Protocol (SCTP). TCP and SCTP provide reliable, end-to-end service.

Which of the following protocol is in transport layer? ›

Which of the following are transport layer protocols used in networking? Explanation: Both TCP and UDP are transport layer protocol in networking. TCP is an abbreviation for Transmission Control Protocol and UDP is an abbreviation for User Datagram Protocol. TCP is connection oriented whereas UDP is connectionless.

Learn More ›

What is the TLS 1.3 protocol? ›

In a nutshell, TLS 1.3 is faster and more secure than TLS 1.2. One of the changes that makes TLS 1.3 faster is an update to the way a TLS handshake works: TLS handshakes in TLS 1.3 only require one round trip (or back-and-forth communication) instead of two, shortening the process by a few milliseconds.

Discover More Details ›

Is HMAC used in TLS? ›

HMAC makes it possible to confirm the data integrity and authenticity of a message. This is especially useful in scenarios like digital signatures, certificate authorities, and transport layer security and secure sockets layer (TLS and SSL) protocols.

Show Me More ›