I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure configuration.
On PCI DSS guidance sections says:
Secure transmission of cardholder data requires using trusted keys/certificates, a secure protocol for transport, and proper encryption strength to encrypt cardholder data
From the above, does TLS 1.1/1.2 covers all stated points? 1. Only use trusted keys/certificates (as signed by trusted authorities) 2. A secure protocol for transport 3. A proper encryption strength
So my question would be: 1. Using only TLS (either 1.1 or 1.2) with a secure configuration is enought for compliance (of this point)? 2. If above is not true, the sistem should include additional encryption on top of that?