TLS should be, at least in a broad and theoretical sense, a transport layer protocol. But TLS provide authentication through X.509 certificates which are based on a hostname, server name, or whatever kind of "name" that should only exist at application level (Unless we only authenticate ip addresses). So in practice TLS span largely between the application and transport layer. Now I was wondering, are there technical and practical reasons why TLS was not designed to simply provide key exchange methods, and the establishment of a encrypted statefull channel leaving certificates verification to the application layer, creating a smoother transport layer protocol with a more linear interface?

1 Answer 1


Transport layer protocols like UDP, TCP, SCTP ... are traditionally implemented at the operating system kernel. While it would probably be possible to design a protocol which does encryption at the transport layer (or network layer like IPSec), adoption of the protocol would thus require changes to all relevant OS. This means adoption of the protocol would probably be very slow.

At the time SSL was invented Netscape not only created the major browser but also major server software. It was thus much easier and faster to add the protected transport directly into the application software (both client and server) instead of trying to get a maybe more academically clean approach into the various OS.

Apart from that OSI model and TCP/IP model are just abstract views to how networking worked at the time these models were created. While at this time the complexity was largely at the lower layers, the complexity today is at the higher layers and the OSI and TCP/IP model do not address today's complexity any more. Just take QUIC, HTTP/2 or even WebSockets which implement transport layer tasks inside the application layer.

  • I assumed that certificate validation is managed at the OS level but that did not sit well with how I understand browsers so now I have locked myself neatly into a catch-22. Each existing client does not implement it's own validation, does it? If not, how/where is that delegated to? The OS? Commented Feb 21, 2022 at 19:26
  • 1
    @LievenKeersmaekers: certificate validation is done in the TLS library. Which TLS library is used depend on the specific application. Even on OS like Windows or MacOS which have their native TLS library coming with the OS browsers like Chrome or Firefox and also programming languages like Python or Go don't use the native TLS library. Commented Feb 21, 2022 at 20:05
  • Exactly the explanation I needed, thank you. So it is the responsibility of each application to do the validation. That's not handled automagically. Commented Feb 21, 2022 at 20:07
  • @LievenKeersmaekers: correct. Commented Feb 21, 2022 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .