TLS adapters

8 adapters. One agent.

Whatever your client speaks, whatever your server demands — TLS Lane reconciles them on the wire. No endpoint changes. Find your case:

Crypto

Quantum adapter
client offers hybrid (X25519MLKEM768) → TLS Lane → server demands pure ML-KEM-768
Connect hybrid-PQC clients to a pure ML-KEM-768 server.
tlslane splice --pure-pqc
Legacy → PQC
client offers classical only (X25519/P-256/RSA) → TLS Lane → PQC-capable server
Make a classical-only client's connection quantum-safe without touching it.
tlslane splice
PQC → classical fallback
client offers PQC only → TLS Lane → classical-only server (OpenSSL < 3.5)
Keep a PQC-only client working against legacy servers that have no PQC.
on by default

Protocol

Protocol uplift
client speaks TLS 1.2 → TLS Lane → server speaks TLS 1.3
Give a TLS 1.2 client the benefits of TLS 1.3 — without changing the client.
tlslane splice
Legacy reach
client speaks TLS 1.3 only → TLS Lane → TLS 1.2-only server
Let a modern TLS 1.3-only client talk to an old TLS 1.2-only server.
tlslane splice

Identity

mTLS piggyback
plain client, no certificate → TLS Lane → mTLS-required upstream
Present a client certificate to an mTLS upstream — your app sends none.
tlslane splice --client-cert <pem> --client-key <pem>
Identity-preserving mTLS
client with its own identity → TLS Lane → mTLS upstream (CA-based trust)
Carry each client's real identity to an mTLS upstream — without holding their keys.
tlslane splice --mint-client-cert --client-ca <pem>

Certificate

Bring your own cert
external clients → TLS Lane → your service
Serve inbound clients your real certificate — no CA install required.
tlslane splice --cert <pem> --key <pem>