---
title: Always Use TLS For All Connections
impact: HIGH
impactDescription: protects data in transit from eavesdropping and tampering
tags: tls, https, encryption, transport, security, kotlin
---

## Always Use TLS For All Connections

Transmitting data over unencrypted HTTP, JDBC, or Redis connections exposes sensitive information to everyone on the network path. All connections in production must use TLS 1.2 or higher.

**Incorrect (unencrypted connections):**

```kotlin
// HTTP API calls
val client = HttpClient(CIO)
client.get("http://api.sun-asterisk.vn/users")

// Unencrypted database connection
val url = "jdbc:postgresql://db.sun-asterisk.vn:5432/mydb"

// Redis without TLS
val config = Config().apply {
    useSingleServer().setAddress("redis://redis.sun-asterisk.vn:6379")
}
```

**Correct (TLS/SSL everywhere):**

```kotlin
// HTTPS for all APIs
client.get("https://api.sun-asterisk.vn/users")

// TLS for Database (via JDBC parameters)
val url = "jdbc:postgresql://db.sun-asterisk.vn:5432/mydb?ssl=true&sslmode=verify-full"

// Redis with TLS
val config = Config().apply {
    useSingleServer().setAddress("rediss://redis.sun-asterisk.vn:6380")
}

// Ktor: Force HTTPS using HSTS
install(HSTS) {
    maxAgeInSeconds = 31536000 // 1 year
    includeSubDomains = true
}

// Redirect HTTP to HTTPS in Ktor
install(HttpsRedirect) {
    sslPort = 443
    permanentRedirect = true
}
```

**Requirements:**
- Minimum TLS version: **1.2** (Recommended: **1.3**).
- Validate server certificates against a trusted CA (avoid `allowSelfSigned`).
- Use `rediss://` for secure Redis.
- Use `ssl=true` for database drivers.

**Tools:** SSLyze, Qualys SSL Labs, OWASP ZAP, Manual Review