Encryption in Transit

Also Known As

TL;DR

Explanation

Encryption in transit uses TLS (Transport Layer Security) to protect data between: browsers and web servers (HTTPS), services communicating internally (mTLS), application servers and databases, and message queues. HTTPS alone is insufficient if internal traffic is unencrypted — an attacker who compromises an internal network segment can intercept database credentials. Mutual TLS (mTLS) requires both parties to present certificates, eliminating the need for credentials in service-to-service communication.

Common Misconception

Why It Matters

Common Mistakes

• MySQL connection without SSL — credentials and all data in plaintext on the network.
• CURLOPT_SSL_VERIFYPEER = false — disables certificate verification, enabling MITM.
• Internal microservice communication over plain HTTP — encrypted external, unencrypted internal.
• Not using HSTS — allows the first request to be downgraded from HTTPS to HTTP.

Code Examples

// Unverified TLS — MITM possible:
$ch = curl_init('https://payment-api.internal');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Never!

// MySQL without SSL:
$pdo = new PDO('mysql:host=db.internal', 'user', 'pass');
// Credentials and queries in plaintext

// Verified TLS:
$ch = curl_init('https://payment-api.internal');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);    // Default — keep it
curl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-certificates.crt');

// MySQL with TLS:
$pdo = new PDO(
    'mysql:host=db.internal;ssl_ca=/etc/ssl/mysql-ca.pem',
    'user', 'pass',
    [PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => true]
);

// mTLS with client certificate:
curl_setopt($ch, CURLOPT_SSLCERT, '/certs/client.crt');
curl_setopt($ch, CURLOPT_SSLKEY,  '/certs/client.key');

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html

Tags

Related Terms