What are SSL and TLS?

The origins of the SSL protocol

The SSL (Secure Socket Layer) protocol was created in 1994 by NestScape (the leading Internet browser at the time) in response to growing concerns about web security. The company’s goal was to create a new secure communication standard, consisting of encrypting data transmitted between a website and its visitor. It was quickly adopted by e-commerce businesses to secure online payments and was soon identified by shoppers as a sign of trust before entering their credit card numbers.
The SSL 2.0 standard was used from 1995 and was gradually replaced by SSL 3.0, which was used until 2015. This latest version greatly inspired its successor, the TLS standard.

The new TLS standard

Following the dissolution of NestScape, the IETF (Internet Engineering Task Force), the group behind most Internet standards, took up the mantle and improved SSL, renaming it TLS (Transport Layer Security) in the process. This new version retained the features of SSL 3.0 while improving the hashing functions used to authenticate the electronic signature of certificates.

TLS is therefore an evolution of SSL, but as the latter is better known, the old acronym is still widely used in everyday language to refer to a TLS certificate. This is not entirely wrong, since TLS is an evolution of SSL.

What is the difference between HTTPS and SSL?

Are you familiar with the OSI (Open Systems Interconnection) model? It is the global communication standard that governs communications between computer systems. The model is structured into 7 layers divided into two categories: lower (hardware) layers and upper (software) layers. Here is how the standard is structured:

 

OSI Model              Protocols  

7 – application layer   HTTP, HTTPS, SMTP, FTP…

6 – presentation layer        TLS, SSL…

5 – session layer    TLS, SSL, SSH-user…

4 – transport layer                TCP, UDP…

3 – network layer           IPv4, IPv6…

2 – data link layer      Ethernet, 802.11 WiFi…

1 – physical layer       Cable, optical fiber, radio waves…

 

SSL therefore sits between the transport and application layers, meaning that it handles:

• Communication synchronization and transaction management: layer 5, Session
• Data encryption and decryption to make it usable: layer 6, Presentation

HTTPS, on the other hand, is located at layer 7, Application. It combines the security of the SSL/TLS protocol with the well-known HTTP, which is THE communication protocol of the World Wide Web. It manages, for example, web addresses (called URLs), the sending and receiving of data between the visitor and the website (GET and POST), and password authentication. It returns information in HTML format, which is interpreted by the browser.

The SSL/TLS certificate

To establish a secure TLS connection, the visitor must authenticate the website they are connecting to. To do so, the server must host a digital certificate, which can be seen as an electronic ID card used to authenticate the website and encrypt data exchanges.
In this case, it must comply with the X.509 standard and be issued by a certificate authority, which acts as a trusted third party by certifying the identity of the website.

Certificate authorities are organizations recognized by Internet authorities, which guarantee their reliability. These organizations distribute public keys that are directly integrated into browsers.

A certificate contains two keys:

• A public key, or root certificate, which authenticates the authority and validates the certificate.
• A private key, which is hidden and used to encrypt data exchanges.

There are many types of certificates (free or paid), offering different types of services and guarantees. To find out more, read our article “The different types of SSL certificates.”

To go further, let us look at how all of this works in practice.

 

How an SSL/TLS connection works in HTTPS browsers

Here are the different stages of a secure SSL/TLS connection between a website and a visitor:

• The browser sends the HTTPS website a request to establish a secure TLS connection.
• The website sends its certificate back to the browser. It contains its public key, its information (company name, address, etc.), and an encrypted electronic signature.
• The browser attempts to decrypt the certificate signature using the public keys of known certificate authorities stored by default in the browser.
• If successful, the browser identifies the corresponding certificate authority, verifies that the certificate has not expired, and sends a request to the authority to determine whether the certificate is still valid.
• If none of the public keys work, the browser uses the public key contained in the website’s certificate. This means that the website has signed its own certificate. A warning message may therefore appear to inform the user that the identity of the website has not been certified by an authority and that there is a potential risk.
• If the certificate is invalid, the connection cannot be established and an error message appears.
• If the connection is validated, the browser then generates a symmetric encryption key from the public key, which makes it possible to establish a session with the server.
• The server then decrypts this session key using its private key. The TLS connection is considered established, and encrypted data can begin to be transmitted.
• Once the connection is terminated or expires, the server revokes the session key.

Conclusion

The success of SSL lies in its ease of use for end users. Indeed, all browsers are compatible, and communication takes place without any prior action by the visitor, who is simply informed by the display of a padlock (generally green) in the address bar. This indication is a sign of trust that has long been recognized by visitors and given considerable weight. An English study conducted by TNS PLC revealed that 75% of visitors left an online store if it was not secure.
The encryption methods used are known to be robust and provide security for data exchanges, protecting passwords, form data, and banking details.
However, although SSL has existed since the early days of the Internet, it has too often remained confined to payment platforms, while large amounts of personal data now pass through websites. Giants such as Google have understood this and decided to take strong action, warning browser users of the risk they face on a website not secured with SSL and granting an SEO ranking boost to HTTPS websites. SSL is now intended to become the leading standard for exchanges on the web.

[dt_button link= »/notre-offre/ » target_blank= »false » button_alignment= »default » animation= »fadeIn » size= »medium » style= »default » bg_color_style= »custom » bg_color= »#333333″ bg_hover_color_style= »custom » bg_hover_color= »#444444″ text_color_style= »custom » text_color= »#ffffff » text_hover_color_style= »custom » text_hover_color= »#dddddd » icon= »fa fa-chevron-circle-right » icon_align= »left »]DISCOVER OUR HTTPS OFFER[/dt_button]