TLS is the standard that encrypts traffic on the internet. It is TLS that gives you the padlock in the browser. Domino uses TLS for web, mail and other internet protocols.
TLS stands for Transport Layer Security. It is the standard that encrypts traffic on the internet. When you see a padlock in the browser and the address starts with https, TLS is at work. TLS replaced the older SSL. Many people still say SSL certificate, even though it is TLS today.
What does TLS do?
TLS takes care of three things:
- Secrecy: Nobody can read the traffic on the way.
- Identity: A certificate shows that you are talking to the right server.
- Unchanged content: Nobody can change data on the way without it being noticed.
When the connection starts, the two machines agree on a shared key. Today that agreement is built on methods such as RSA and ECC. The rest of the traffic is encrypted with the shared key.
TLS 1.2 and TLS 1.3
TLS 1.2 came in 2008 and is still widely used. TLS 1.3 came in 2018. It is faster, because the connection starts with fewer steps. It is also safer, because old and weak methods have been removed. The new quantum safe ways to agree on keys are built for TLS 1.3.
TLS in HCL Domino
Domino uses TLS for web, for mail between servers and for protocols such as IMAP and LDAP. The classic internet part of Domino can only do TLS 1.2 today. Some newer parts of Domino 2026 can use TLS 1.3, for example when LotusScript fetches data from the web. HCL has said that all of Domino gets TLS 1.3 in Domino 2027.
This matters for two reasons. Many companies and authorities require TLS 1.3. And TLS 1.3 is the path to quantum safe encryption in Domino. Read more in the article on Notes 2026 and Domino 2027.
Remember the certificates
A TLS certificate expires. From 2026 the lifetime of public certificates gets shorter step by step. That is why renewal should happen automatically. Domino has its own certificate manager that can renew certificates by itself. We are happy to set it up as part of our Domino operations and Notes support.