Encryption in Transit
Protecting data as it moves between systems — table stakes on the public internet, and increasingly mandatory inside your own network too.
What is encryption in transit?
Encryption in transit secures data crossing a network so eavesdroppers can neither read nor tamper with it — in practice, TLS for almost everything (HTTPS, database connections, API calls), with mTLS and service meshes handling the machine-to-machine case. On the public internet it’s non-negotiable and long since default; the live debate has moved inside the perimeter.
The internal-traffic shift
The old model encrypted the internet-facing edge and let traffic run plaintext within the “trusted” network. Zero trust rejects that: the network is assumed hostile, so service-to-service traffic gets encrypted too — via mTLS, where both sides present certificates, authenticating identity and encrypting the channel. This is exactly what service meshes automate (transparent mTLS with cert rotation, no application changes), and it’s why “we terminate TLS at the load balancer and go plaintext to backends” is now a finding in security reviews rather than an accepted pattern — the segment between LB and app is a network segment like any other.
TLS termination: where it ends matters
Edge termination (decrypt at CDN/load balancer, plaintext to origin) is simplest and fine when that internal hop is genuinely trusted and short. Re-encryption (decrypt at edge for inspection/routing, re-encrypt to backend) preserves in-transit protection end-to-end. Passthrough (backend terminates TLS itself) maximizes secrecy but forfeits edge inspection and L7 routing. The choice is a security-versus-capability trade, made per-route, not once globally.
What people get wrong
- Trusting the internal network and running plaintext behind the load balancer — the assumption zero trust exists to kill.
- Expired certificates as a leading self-inflicted outage: automate renewal (Let’s Encrypt/ACM) and alert early.
- Weak configs: old TLS versions and cipher suites; enforce TLS 1.2+ and let managed services pick modern defaults.
Primary source: NIST SP 800-52 Rev. 2 — TLS Guidelines
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.