From SSL to TLS: A Passport Adventure Through the Internet

Pull up a chair, grab your lunch, and let’s go on a journey. Imagine the internet as an airport — yes, the whole thing. Millions of people (data packets) flying around daily, hopping on planes (networks), trying to reach their destinations. But here’s the catch: without passports, visas, and security guards, this airport would be pure chaos.

That’s where SSL and TLS come in. And lucky for us, they work a lot like the passport application process.

What Even Is the Network?

(“Wait, who owns this airport anyway?”)

When you send or receive information on the internet, your data doesn’t fly directly from your laptop to your favorite social media app server. Nope. It hops through a whole chain of connecting flights:

• Your Wi-Fi router (local shuttle bus)

• Your ISP’s backbone (regional airport)

• Submarine cables or satellite relays (international flights)

• Data center routers and switches (immigration checkpoints)

This interconnected web of stops is what we simply call “the network.” It’s like flying from Lagos to San Francisco with three layovers: every hop matters, every stop is a physical device forwarding your data like airport staff passing you along.

And just like in airports, if your passport is transparent, every guard along the way can read your secrets. Historically, that’s exactly what happened, data was sent in plain text.

How a Normal Flight (Request) Works

(“Okay, show me your documents.”)

Here’s what happens when you type https://example.com into your browser:

1. DNS Resolution: You ask the Directory Office where Example Airlines is located. This is the DNS server handing you the IP address (like giving you the terminal and gate number).

2. TCP Handshake: Before boarding, you and the airline shake hands:

   • SYN: “Hey, I want to fly.”
   • SYN-ACK: “Cool, we’re ready for you.”
   • ACK: “Great, let’s go.” The connection (your boarding gate) is open.

3. TLS Handshake: Now the airline (server) pulls out its passport (TLS certificate). But wait — you (the client) are the border officer here. It’s your job to check the airline’s documents.

Why the Client is the Border Guard

(“Papers, please!”)

Think about it:

• The server already knows who it is.
• But you (the traveler) need to confirm you’re boarding the right flight, not being scammed by some shady airline named “Exampl3.com.”

So your browser inspects the airline’s passport:

• 📝 Is it signed by a recognized passport authority (CA)?
• 📝 Does the name match (example.com)?
• 📝 Is it still valid, not expired?
• 📝 Has it been revoked for fraud?

If everything checks out, the officer (your browser) stamps “Approved” and the flight proceeds. If not, you get the dreaded red browser warning screen: “This airline’s passport is fake, do not board!”

Who Issues the Passports? (CAs)

(“Who gave you this passport, anyway?”)

Enter the Certificate Authorities (CAs) — the global passport offices of the internet.

Some famous ones you’ve probably “flown with”:

• DigiCert (the fancy old-school embassy)

• GlobalSign (the veteran official)

• Let’s Encrypt (the cool nonprofit giving out free passports)

• Google Trust Services (GTS Root R1–R4. Yep, Google runs its own passport office)

When a server applies for a passport (certificate), here’s what happens:

1. The server generates a private key + public key pair (like posing for ID photos).

2. It submits a Certificate Signing Request (CSR) (like filling out the application form).

3. The CA verifies identity (domain control, org documents, etc.).

4. The CA signs and issues the passport (TLS cert).

Now your server can fly across the internet without suspicion.

But What About DNS?

“Even the directory office needs passports.”) DNS is the directory desk in this airport analogy. Traditionally, DNS queries were shouted across the terminal:

• “HEY, WHERE IS EXAMPLE.COM?”
• Anyone nearby (hackers, shady guards, curious fellow passengers) could hear you.

That’s because DNS ran over plain UDP port 53, no encryption, no passports. Modern fixes:

DNS over HTTPS (DoH): Wraps DNS queries inside HTTPS (TLS), now you whisper in a private booth. DNS over TLS (DoT): Same idea, dedicated TLS-encrypted channel on port 853. DNSSEC: Adds signatures to prove records haven’t been tampered with (like a notarized directory).

So yes, DNS servers are also “airlines,” and when you use DoH/DoT, they show their passports too.

SSL vs TLS — The Naming Mess

(“Why do old guards still say SSL?”)

Now, here’s the twist. Back in the 90s, Netscape invented the first passports: SSL (Secure Sockets Layer).

• SSL 2.0 and 3.0 were full of holes (think fake lamination, easily forged).
• In 1999, the IETF stepped in and issued new passports under a new standard: TLS (Transport Layer Security).

But old habits die hard. People still call them “SSL certificates” even though everyone is really using TLS now.

Today:

• SSL is dead and buried.
• TLS 1.2 and TLS 1.3 are the valid passports.
• TLS 1.3 is the cool new biometric passport: faster, cleaner, only strong crypto allowed.

The Whole Journey Recap

Let’s recap your packet’s journey through the airport of the internet:

1. DNS (Directory Office): Where’s Example Airlines?

2. TCP Handshake (Boarding Gate): Do we agree on a communication channel?

3. TLS Handshake (Passport Control): Server shows passport, client verifies.

4. Encrypted Flight (Data Transfer): You fly safely across networks, nobody can peek inside.

5. Arrival: The server decrypts and delivers your webpage.

And all this happens in milliseconds while you’re scrolling memes at lunch. 🥪😎

Final Thoughts

The next time you hear “SSL/TLS” or “HTTPS,” just picture a giant airport where every packet needs a passport. The CAs are the passport offices, your browser is the border guard, and TLS is the shiny biometric passport that ensures no shady imposter airline flies off with your secrets.

Without TLS, the internet would still be like mailing postcards — fun for the postman, terrible for privacy.

So next time Chrome asks if you really want to “proceed without a valid certificate,” remember: that’s like sneaking onto a shady plane with a fake passport. And honestly, who wants that adventure?