Transport Layer Security (TLS)
Transport Layer Security is the protocol that encrypts and authenticates traffic between a mobile application and the services it talks to.
Presence of TLS is not by itself a passing result. Assessments look at negotiated version and cipher suite, whether certificate validation is genuinely enforced or silently accepts any certificate, whether cleartext fallback is permitted by the network security configuration, and whether sensitive fields are additionally protected at the application layer.
Custom trust managers that accept every certificate remain one of the most common serious findings in mobile assessments, usually introduced to unblock a debugging session and never removed.
Related terms
- Certificate pinning — Certificate pinning is a control in which an application accepts only a specific certificate or public key for a server, rather than any certificate signed by a trusted authority.
- Man-in-the-middle interception — Man-in-the-middle interception is the positioning of a proxy between an application and its servers so that traffic, including TLS-protected traffic, can be read and modified in transit.