What is SSL/TLS?

Urgent update: By June 30, 2018, website owners will be required to stop using SSL/early TLS and upgrade to a later version of the TLS protocol – in order to comply with the PCI Data Security Standard (PCI DSS) for secure payment communications. TLS v1.2 is strongly recommended at the moment, though TLS v1.3 is just around the corner.

What is SSL?

SSL (Secure Sockets Layer) is an encryption protocol developed by Netscape in 1995. It allows for browsers on computers and mobile devices to safely communicate with online websites. That is, without compromising user data to cybercriminals or anyone else trying to access it without authorization.

This data includes:

  • Payment information;
  • Passwords;
  • Any other type of personal information;

SSL 2.0 was actually the first version released to the public, since 1.0 had massive security flaws. Soon after, SSL 3.0 became the norm after some vulnerabilities were found with the SSL 2.0 protocol. In 2014, a security team hired by Google discovered a significant vulnerability in SSL (named “POODLE”), so everyone was encouraged to transition to TLS.

What is TLS?

TLS 1.0 was actually released in 1999, three years after SSL 3.0, and was considered a much-needed improvement over the previous system.

For all intents and purposes, SSL and TLS (Transport Layer Security) are the same thing. That’s why so many online articles just use “SSL/TLS” when talking about the technology, even though TLS is considered an upgrade over SSL. A significant difference (aside from the boost in security) is that TLS can be used by applications other than browsers (such as email clients and voice over IP).

In fact, SSL is no longer being offered at all. When people buy “SSL certificates” online, what they’re actually getting are TLS certificates. The “SSL” name is still in use in order to prevent the inevitable confusion, though the bottom line is that both protocols do the same thing, but one of them (TLS) does it better.


How Does TLS Protect User Data?

As mentioned before, SSL/TLS encrypts user data as it is transmitted over the web. In simple terms, those trying to read one’s personal information will find only a series of garbled characters. To decipher those characters, the viewer requires the right cryptographic key (which is usually a very large number).

There are two main categories of encryption algorithms used to keep user data safe: symmetric and asymmetric. The latter algorithm is considered the most secure, though symmetric ciphers are still used internally by governments and companies.

In the former’s case, a single cryptographic key needs to be exchanged between the sender and receiver before the decryption can start. One “code-word” mentioned to the guard before entering a top-security building. The Advanced Encryption Standard (AES) is one such type of symmetric cipher.

Asymmetric algorithms – such as the RSA (Rivest–Shamir–Adleman) protocol – make use of public and private cryptographic keys, which are tied together by extremely complex mathematics. In this case, to enter the top-security building, one needs to correctly answer the “question” posed by the guard at the entrance.

More on Asymmetric Algorithms

In fact, asymmetrically-encrypted connections are much more complicated than that. They are far too resource-intensive to be used in real-time. That is one crucial reason why they are so hard to decrypt in the first place.

As such, when a client (user) and server (website) connect this way, they asymmetrically decide on a single, shared, symmetric cryptographic key to be used throughout the browsing session. This is all done during a process called an SSL handshake.

To continue the above analogy: after answering the guard’s “question” correctly, both parties decide on a code-word they have to use at the same time in order to pass through a second door in the top-security building. This is where the exchange of information can finally begin securely.

If asymmetrical algorithms were used in real time, it would work like this:

Each time the user would try to say one word (or piece of internet data) to the guard, they would have to answer a new question correctly. Otherwise, the conversation cannot continue. Obviously, this type of communication would be incredibly slow and cumbersome.

What Is an SSL Handshake?

An SSL handshake is the process by which the client and the server decide how to proceed with the connection. This complex task establishes multiple aspects of the connection, such as:

  • the cryptographic keys to be used;
  • the encryption type;
  • the server’s identity;
  • whether or not the connection is secure;

How to Identify a TLS Certificate

First off, any website that uses an SSL/TLS certificate can be identified by the “https:” (HTTP Secure) and green “padlock” icon before the actual URL of the page. On the other hand, certain browsers may just display the lock icon and skip the “https:” altogether.

Websites that have their full company name displayed after the green lock have been accredited with an extended validation certificate (EV), which is the strictest level of validation available.

Depending on the browser, clicking/tapping on the green lock brings up a small menu showing that the connection to the website is secure and/or accredited by a trusted authority. Clicking “Details”, “More information”, “Learn more”, or similar options found in this menu will bring up many technical details, including (but not limited to):

  • The Certificate Authority (CA) that issued the website’s SSL certificate;
  • SSL/TLS version (e.g. TLS 1.2);
  • The encryption cipher used (e.g. AES, RSA);
  • Duration of validity for the certificate;

Is a TLS Certificate Legally Required?

Technically, no. EU laws, for example, only state that companies that store, send and receive personal data need to do so securely. SSL/TLS certificates happen to be the trusted way of securing personal data at the moment.

Instead, website owners should worry more about what Google, Mozilla and similar entities have to say. Essentially, HTTP-only websites have become marked as “unsafe” in Chrome and Firefox. That is, even if those websites do not collect user data such as payment information. Moreover, these sites are also punished in search engine rankings.

Why Choose Buffered VPN

  •   Ultra-fast servers in 46 countries
  •   30-day money-back guarantee
  •   256-bit Encryption
  •   Zero usage logs
  •   User-friendly, intuitive VPN client
  •   24/7 live human support
  •   5 simultaneous connections
  •   Unlimited bandwidth

Looking for a robust – fast and reliable VPN try @BufferedVPN – unbeatable after sales service.

@BufferedVPN has ridiculously good customer service.

Have been pretty happy with @BufferedVPN so far.

Made with in Gibraltar | © Copyright 2018 Buffered™ Ltd.