¶ºÒõ¹Ý

If you’ve Googled SSL before, then you’ve probably seen the term TLS as well. SSL and TLS are sometimes used interchangeably because they are very closely related. In fact, you can think of TLS as an upgraded version of SSL. Both protocols encrypt information at the same level, but just like other technologies, they evolve over time.

Secure Sockets Layer (SSL) and Transport Security Layer (TLS) are both protocols used to encrypt communications between a web server and a user’s web browser. Both SSL and TLS encrypt these communications by . TLS uses slightly different cryptographic algorithms for MAC function generation of secret keys and includes more alert codes than its predecessor, SSL.

SSL 2.0

The first usable version of SSL—SSL 2.0—was designed by Netscape and released in 1995. However, vulnerabilities were found in SSL 2.0, requiring Netscape to design a better, more secure version. SSL 3.0 came out a year later. SSL 3.0 was still widely used until fall 2014 when a major security vulnerability was found by the Google security team.

The Move from SSL to TLS

TLS was first designed as another protocol upgrade of SSL 3.0 in 1999. Though the differences aren’t considered dramatic, they are significant enough that SSL 3.0 and TLS 1.0 don’t interoperate. SSL 3.0 is seen as less secure than TLS.

TLS 1.1 was created in 2006, and TLS 1.2 was released in 2008. TLS 1.2 is the version in use today. TLS 1.3 is in draft as of January 2015, but is not yet released. As with any other protocol upgrade, TLS is seen as more secure than SSL 3.0 because of added measures to block exploitation and mitigate vulnerabilities on each version.

POODLE and Other SSL Vulnerabilities

One of the reasons SSL 3.0 is being phased out is because of the numerous known vulnerabilities. As mentioned before, one of Google’s teams found a major issue in 2014 called POODLE.

The vulnerability takes advantage of SSL 3.0 fallbacks built into clients and servers. Essentially, the attack forces the use of SSL 3.0 and then uses this to decrypt parts of the session content. Doing this byte by byte can reveal large parts of the connection with the server and client. A POODLE attack could be used on any system that supports SSL 3.0 with cipher-blocking chaining mode ciphers.

Even before POODLE, there were other vulnerabilities in the SSL protocol like BEAST and BREACH. BEAST, originally found in 2002, highlighted a CBC vulnerability in TLS 1.0 and earlier protocols, but it wasn’t practically demonstrated until 2011, which encouraged Microsoft, Apple, and browsers to create a workaround.

BREACH uses HTTP compression to exploit HTTPS and was presented in 2013. Clients and servers had to use cross-site request forgery protection to work around the vulnerability.

SSL and TLS: What’s the Difference?

As you can see, there have been security issues with SSL 3.0 for many years, which necessitated a more secure solution. As with any other technology update, there are differences in each version but the end product is the same for the end user. When people refer to SSL or TLS, they are usually talking about the same thing unless they are referring to the different versions of the protocol.

The terms SSL and TLS are used interchangeably because the protocols encrypt information the same way and, on the most basic levels, do the same thing. TLS is simply and upgraded and more secure version of SSL. TLS is widely used throughout the web today, and is the top choice for transaction security. All versions of SSL and TLS can be enabled at the same time on a server.

All ¶ºÒõ¹Ý digital certificates are compatible with SSL and TLS protocols. However, because of the notable vulnerabilities in SSL 3.0, ¶ºÒõ¹Ý recommends disabling SSL 3.0 on your server completely if you have not already done so. By disabling SSL 3.0 and enabling TLS, admins will receive the same level of encryption without the vulnerabilities. If you are unsure about what SSL/TLS versions you have enabled, you can use the Certificate Inspector for vulnerability scanning, analytics, and more.