What is an Encryption in Transit?

The most familiar form is TLS (the 'S' in HTTPS), which encrypts and authenticates the connection between a client and a server so a network observer — a coffee-shop Wi-Fi eavesdropper, a compromised router — can't read or tamper with the traffic. The same principle applies internally: service-to-service calls within a data center or cloud VPC should also run over TLS rather than assuming the internal network is inherently trustworthy, since a compromised host on that network could otherwise sniff plaintext traffic. Encryption in transit protects data while it's moving; it says nothing about what happens to that data once it lands on disk, which is why it's always paired with encryption at rest as a complementary, not overlapping, control. A system can have perfect TLS everywhere and still leak data badly if it stores things in plaintext at the destination. Certificate management (issuance, rotation, revocation) is the usual operational burden here, which is why most modern platforms automate it rather than handling certificates by hand.