TLS & Certificates
TCP gives transport but not confidentiality or identity: the handshake, key agreement, certificates and the chain of trust.
TCP delivers bytes reliably to an address; it says nothing about who is reading them, who is changing them, or whether the address is the server you meant — TLS is the layer that adds confidentiality, integrity and authenticated identity on top of a transport that has none.
Before the first encrypted byte, client and server negotiate a version and cipher suite, the server proves its identity with a certificate and a signature, and both derive the same session key from an ephemeral key exchange — one round trip in TLS 1.3, two in TLS 1.2, on top of TCP’s own.
A certificate binds a hostname to a public key with a signature from an issuer the client already trusts; the client walks leaf → intermediate → root, checks names, dates and signatures, and every classic TLS outage is one of those checks failing.