What is TLS?

TLS is the encryption protocol that secures data transferred between browsers and web servers. CloudSonic enforces TLS 1.2 and 1.3 on every server with older insecure versions disabled by default.

CloudSonic
CloudSonic Written & updated by the CloudSonic Team
Last Updated September 10, 2026

TL;DR TLS

TLS stands for Transport Layer Security and it is the cryptographic protocol that secures data transmitted between a web server and a browser. When you visit a website using HTTPS, TLS is what is encrypting the connection. It works by establishing an encrypted tunnel between the two parties so that any data travelling through it, including passwords, form submissions, and personal information, cannot be read or tampered with by anyone in between. TLS replaced its predecessor SSL, which is why the certificates used to enable HTTPS are still commonly called SSL certificates even though the protocol doing the work is TLS. The current versions in active use are TLS 1.2 and TLS 1.3. CloudSonic enforces TLS 1.2 and 1.3 on every server with older insecure versions disabled by default. TLS 1.3 in particular offers faster handshakes which contributes to a lower TTFB and a better user experience.

How TLS Works

TLS secures a connection through a process called the handshake, which happens before any application data is exchanged. In TLS 1.3, the current recommended version, the handshake works as follows. The client sends a hello message that includes the TLS version it supports, a list of cipher suites it can use, and a random value. The server responds with its chosen cipher suite, its SSL certificate, and its own random value. The client verifies the certificate against its list of trusted Certificate Authorities. Both parties then use a key exchange algorithm, typically X25519, to derive a shared secret without ever transmitting that secret over the network. This shared secret is used to generate the symmetric encryption keys that protect all subsequent communication. The entire handshake in TLS 1.3 takes only one round trip, compared to two in TLS 1.2, which is one reason TLS 1.3 connections establish faster and contribute to a lower TTFB.


# Check which TLS versions a server supports
nmap --script ssl-enum-ciphers -p 443 cloudsonic.com.au

# Or using openssl to test TLS 1.3 specifically
openssl s_client -connect cloudsonic.com.au:443 -tls1_3

# Check TLS version and cipher in use for a connection
curl -vI https://cloudsonic.com.au 2>&1 | grep -E 'SSL|TLS|cipher'

# Output example:
# * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384

Why TLS Matters for Your Website

TLS is the difference between your visitors' data being private and it being readable by anyone who can observe the network traffic between them and your server. On public WiFi networks, coffee shops, airports, and hotels, unencrypted HTTP traffic can be intercepted trivially with freely available tools. Without TLS, a visitor logging in to your WordPress admin, submitting a contact form, or completing a checkout is transmitting that data in plain text. TLS encrypts all of it so that even if the traffic is intercepted it is unreadable. Beyond the direct security benefit, TLS is required for HTTP/2 and HTTP/3, meaning you cannot benefit from the performance improvements those protocols offer without it. TLS 1.3 specifically makes connection establishment faster through its one round trip handshake, which reduces the connection overhead component of TTFB. Security and performance are not in tension here. Properly implemented TLS improves both.

Frequently Asked Questions on TLS

What is the difference between TLS 1.2 and TLS 1.3?

TLS 1.3 is faster and more secure than TLS 1.2. The handshake requires one round trip instead of two, which reduces connection establishment time and contributes to a lower TTFB. TLS 1.3 also removes support for older cryptographic algorithms that were considered weak, making it more resistant to downgrade attacks. CloudSonic enforces both TLS 1.2 and 1.3, with older versions disabled entirely.

Is TLS the same as HTTPS?

Not exactly. TLS is the protocol that does the encryption. HTTPS is HTTP running over a TLS-encrypted connection. When you see HTTPS in a URL, it means the connection is secured using TLS. The padlock in the browser confirms that TLS is active. An SSL certificate is what enables TLS to work by providing the cryptographic keys and identity verification the protocol requires.

Can TLS be terminated at the edge rather than on my origin server?

Yes and this is exactly how CloudSonic works. Cloudflare Enterprise terminates the TLS connection at the nearest edge node, decrypts the traffic, applies security rules, and forwards the request to your origin server. The connection between Cloudflare and your origin server is also encrypted with TLS. This architecture means the computationally expensive TLS handshake happens on Cloudflare's infrastructure rather than your server, reducing origin server CPU load.