This lesson explains how TLS and PKI work in practical terms for DevOps engineers. Understanding how certificates, certificate authorities, and trust chains function is essential when troubleshooting TLS errors or designing secure infrastructure.
This article is part of the PKI for DevOps Engineers training series, which walks through the tools and concepts used to manage TLS certificates in modern infrastructure.
Table of Contents
- What is TLS?
- What is PKI?
- How the TLS handshake works
- Certificate chains explained
- Why PKI matters for DevOps
- Frequently asked questions
What is TLS?
TLS (Transport Layer Security) is the protocol used to encrypt network connections on the internet. It protects communication between clients and servers so that attackers cannot read or modify transmitted data.
TLS is commonly used for:
- HTTPS websites
- API endpoints
- email servers
- VPN connections
- microservice communication
When you visit a secure website, your browser establishes a TLS connection with the server before any data is exchanged.
—What is PKI?
Public Key Infrastructure (PKI) is the system used to create, manage, and validate digital certificates.
PKI includes several components:
- certificate authorities (CAs)
- digital certificates
- private keys
- certificate revocation systems
- trust stores
The role of PKI is to allow clients to verify that a server’s certificate can be trusted.
If you want a deeper explanation of what certificates are, see our article on what SSL certificates are.
—How the TLS Handshake Works
The TLS handshake is the process used to establish a secure connection between a client and server.
The handshake typically follows these steps:
- The client connects to the server and requests a secure connection.
- The server sends its TLS certificate.
- The client verifies the certificate against trusted certificate authorities.
- The client and server negotiate encryption keys.
- A secure encrypted session begins.
If certificate validation fails during this process, the connection will fail.
DevOps engineers often use tools such as openssl s_client to inspect the certificate presented by a server during this handshake.
—Certificate Chains Explained
Most TLS certificates are not trusted on their own. Instead, they are part of a certificate chain.
A typical chain contains three levels:
- Leaf certificate – issued to the server
- Intermediate certificate – issued by a CA
- Root certificate – trusted by operating systems and browsers
During the TLS handshake, the client validates this chain to confirm that the certificate ultimately traces back to a trusted root authority.
If the chain is incomplete or misconfigured, clients may produce errors such as:
unable to get local issuer certificatecertificate verify failed
You can validate certificate chains manually using openssl verify.
—Why PKI Matters for DevOps Engineers
Modern infrastructure relies heavily on TLS encryption.
Certificates secure:
- web servers
- load balancers
- Kubernetes ingress controllers
- internal microservices
- service meshes
Because of this, DevOps engineers frequently encounter certificate-related issues such as:
- expired certificates
- invalid certificate chains
- hostname mismatches
- Java truststore problems
Understanding how TLS and PKI work makes it much easier to diagnose and resolve these issues.
—Frequently Asked Questions
What is the difference between TLS and SSL?
SSL was the original protocol used for encrypted communication. TLS is the modern and secure successor. Today, most systems use TLS even though the term “SSL” is still commonly used.
What is a certificate authority?
A certificate authority (CA) is an organization that issues digital certificates verifying the identity of servers or organizations.
Why do certificates expire?
Certificates expire as a security measure. Limiting the lifetime of certificates helps reduce risk if a private key is compromised.
What causes TLS handshake failures?
Common causes include expired certificates, invalid certificate chains, unsupported cipher suites, and hostname mismatches.
—Next Lesson
Now that you understand how TLS and PKI work, the next lesson explains the structure of X.509 certificates.