TLS, IT Atlas

Overview

TLS 1.3 simplified the handshake to a single round trip, removed legacy ciphers and made forward secrecy the default. Server identity is proven by a certificate chained to a trusted authority; mutual TLS additionally authenticates the client.

Operationally, TLS is a certificate lifecycle problem. Expiry, incomplete chains, mismatched names and unsupported cipher suites cause more outages than cryptographic weaknesses do.

Security considerations

Disable TLS 1.0/1.1 and legacy cipher suites; monitor for downgrade attempts.
Automate issuance and renewal, and inventory every certificate with its owner and expiry.

Related topics

Certificates & PKI

The hierarchy of certificate authorities, policies and lifecycle processes that issue and validate digital identities.

Load Balancing

Distributing client requests across multiple backend servers to provide scale, resilience and maintainability.

Encryption

Protecting data confidentiality and integrity in transit, at rest and increasingly in use, with key management as the hard part.

TCP/IP

The protocol suite that actually runs the internet and virtually every enterprise network, organised into link, internet, transport and application layers.

OSI Model

A seven layer conceptual model that separates network communication into distinct, independently replaceable functions.

HTTP & HTTPS

The request/response protocol of the web, and its TLS protected form, which now carries most enterprise application traffic.

LDAP

Lightweight Directory Access Protocol is the query and update protocol for directory services, running on TCP/389 or TCP/636 for LDAPS.