Encryption in Transit: TLS, HTTPS, SSH, and VPN

IT & Systems
, , , ,
1

Part of the Encryption in Transit and At Rest series.

What Encryption in Transit Actually Does

When data travels over a network, it passes through routers, switches, and cables that you do not own. On public Wi-Fi, anyone on the same network with the right tools can read unencrypted traffic as it goes by. Encryption in transit wraps the data so that even if it is intercepted, it looks like random noise.

Three tools cover most of what you need: TLS for web and application traffic, SSH for remote access, and a VPN for broader network protection.

TLS and HTTPS

TLS (Transport Layer Security) is the protocol behind HTTPS. When your browser connects to https:// a site, it negotiates a TLS session. The two sides agree on an encryption method, the server proves its identity with a certificate, and from that point on the traffic is encrypted.

How to verify a connection in your browser:

In most browsers, click the site information icon at the left of the address bar. Older browsers show a padlock here; newer ones (including Brave and Chrome) show a tune or sliders icon instead. Choose Connection is secure, then open the certificate details. You will see who issued the certificate and when it expires. What matters:

  • The domain on the certificate matches the site you are visiting
  • The certificate was issued by a trusted certificate authority
  • The certificate has not expired

Browser certificate viewer showing the issuer, domain, and validity dates
Browser certificate viewer showing the issuer, domain, and validity dates1920×1155 238 KB

A plain http:// connection has no encryption. Anything you type on an HTTP page, including passwords, is visible on the network.

Common mistakes:

  • Accepting browser warnings about invalid certificates. Those warnings exist for a reason.
  • Assuming HTTPS means the site is safe. It means the connection is encrypted. The site itself can still be malicious.
  • Using HTTP APIs in applications to save time during development, then forgetting to switch before going live.

References:

SSH

SSH (Secure Shell) encrypts the entire session between your machine and a remote server. The connection uses public-key cryptography to verify identity and symmetric encryption for the session data.

Password auth vs key auth:

Password authentication sends your password over the encrypted channel. It works but can be brute-forced if the server allows repeated attempts. Key-based authentication replaces the password with a key pair. The server holds your public key. Your private key never leaves your machine. Even if someone intercepts the connection, they cannot authenticate without the private key.

Terminal showing SSH key-based login
Terminal showing SSH key-based login1469×244 52.1 KB

See the full guide on SSH keys here: SSH Keys on Windows 11: Native OpenSSH Without the Extra Tools

Best practices:

  • Disable password authentication on SSH servers once key auth is working
  • Use ed25519 keys, they are smaller and faster than RSA
  • Change the default SSH port if the server is public-facing to reduce automated scan noise

VPN

A VPN creates an encrypted tunnel between your device and the VPN server. All traffic going through the tunnel is encrypted, including DNS queries.

What a VPN protects:

  • Your traffic from being read on the local network (public Wi-Fi, shared office network)
  • Your IP address from sites you visit, which see the VPN server’s IP instead
  • DNS queries from your ISP

What a VPN does not protect:

  • Traffic after it leaves the VPN server on its way to the destination. If the destination is HTTP, it is still unencrypted from the VPN exit to the server.
  • Your activity from the VPN provider. You are shifting trust from your ISP to the VPN service.
  • Your device from malware or compromised software

WireGuard is the current standard for modern VPNs, used by self-hosted setups and commercial providers like Proton alike. It is fast, uses modern cryptography, and has a small codebase compared to older protocols like OpenVPN. WireGuard clients are available for Windows, Linux, and macOS.

WireGuard client connected, showing active tunnel
WireGuard client connected, showing active tunnel621×725 117 KB

References:

What Encryption in Transit Does Not Cover

Once data arrives at a server and gets written to disk, in-transit encryption is done. If that server has an unencrypted drive and someone physically removes it, the encryption in transit did nothing to protect the stored data.

That is what the at-rest posts cover.

Continue reading:

  • Encryption at Rest: Linux (coming soon)
  • Encryption at Rest: Windows (coming soon)
  • Encryption at Rest: macOS (coming soon)
  • Back to the series overview

Something specific to your setup? Post below.