Skip to content
Get Started
G2G2
4.7/5
Excellent
Trustpilot

What Is TLS (Transport Layer Security)?

TLS (Transport Layer Security) is the encryption protocol that protects data between a client and a server, and the S in HTTPS. It is the successor to SSL: people still say SSL certificate, but every secure website today uses TLS 1.2 or TLS 1.3.

Try Now for $4.99Continue with Google
  • Session Control
  • High Speed
  • Privacy First
Best fit for TLSStatic ISP Proxiesfrom$0.75/IP
how it works

How a TLS handshake works

TLS runs on top of a TCP connection. In TLS 1.3 (RFC 8446) the client sends a ClientHello with the versions, cipher suites and extensions it supports, the server name it wants (SNI) and a key share. The server answers with its own key share and its certificate, both sides derive the same session keys, and encrypted data can flow after a single round trip.

The certificate proves the server owns the domain: it is signed by a certificate authority that your browser or operating system already trusts. If the name or the signature doesn't check out, the client refuses to continue.

  • 1

    SSL 2.0 / 3.0

    Status
    Prohibited
    Notes
    Broken; SSL 3.0 deprecated by RFC 7568 in 2015
  • 2

    TLS 1.0 / 1.1

    Status
    Deprecated
    Notes
    Formally retired by RFC 8996 in 2021
  • 3

    TLS 1.2

    Status
    In use
    Notes
    Still widely supported, two round trips to set up
  • 4

    TLS 1.3

    Status
    Current
    Notes
    Faster one-round-trip handshake, fewer and stronger ciphers
why it matters

Why TLS matters for proxy users

For https:// sites your client opens a CONNECT tunnel through the proxy and runs TLS straight to the website. The proxy relays encrypted bytes and cannot read or change the pages, headers or cookies.

TLS: what it means for you
  • The proxy still sees the destination hostname, in the CONNECT line and in the TLS SNI field.
  • Your TLS ClientHello passes through untouched, so the site sees your client's TLS fingerprint, not the proxy's.
  • A certificate error through a proxy means something is intercepting TLS, such as a corporate inspection proxy with its own root certificate. A normal forward proxy never causes one.
  • Proxy credentials sent to an http:// proxy URL are not encrypted on the way to the proxy; the site traffic inside the tunnel still is.
try it

Check a site's TLS version

OpenSSL shows the negotiated protocol and cipher suite for any HTTPS server:

CleanProxies proxies carry HTTPS through CONNECT tunnels, end to end. Static ISP proxies also offer SOCKS5, which relays TLS the same way.

Negotiated TLS version and cipherShell
openssl s_client -connect example.com:443 -servername example.com -brief </dev/null
# CONNECTION ESTABLISHED
# Protocol version: TLSv1.3
# Ciphersuite: TLS_AES_256_GCM_SHA384

Static ISP proxies from $0.75/IP

The CleanProxies proxy that fits best here, with a $4.99 trial to test it first.

Static ISP Proxies

Best fit

Dedicated IPs on US carrier ASNs with unlimited bandwidth and threads, never shared.

starting from$0.75/IP

Dedicated static IPs registered to US and Canadian ISPs. The address stays the same for as long as you hold it, with unlimited bandwidth and HTTP(S) or SOCKS5 access.

Buy NowSee Static ISP Proxies features

Go deeper

Guides from the blog

Setup guides and best practices from the CleanProxies blog.

Get the latest insightsAll Blogs

Related terms

Terms that come up alongside TLS.

All glossary terms

TLS FAQs

Straight answers about TLS.

TLS is the successor to SSL. SSL versions are broken and no longer used; the name survives in phrases like SSL certificate, but today's connections use TLS 1.2 or 1.3.

Got more questions?All FAQs