TLS

Verify TLS Server Identity Without Bypasses

A client can establish an encrypted TLS connection and still connect to the wrong server if it does not verify the server’s identity correctly. Encryption protects traffic from observation and modification only within the connection that was established. The client must also decide whether the endpoint at the other end is the service it intended to reach. This matters for browsers, API clients, background workers, mobile applications, service-to-service calls, update clients, and any other software that relies on TLS. A tempting workaround such as “disable certificate verification because the internal certificate is inconvenient” can turn a configuration problem into an authentication failure.