Security on the Web a high level of network security can be ensured by properly encrypting the internet connection. Users are becoming increasingly aware of the dangers lurking online and pay attention to professional data protection in individual services. It is therefore worthwhile to understand how popular information encryption protocols actually differ.

Cryptographic Protocols

SSL and TLS are two cryptographic protocols that provide authentication and data encryption between servers, devices, and applications operating on a network (e.g., a client connecting to a web server). SSL is the predecessor to TLS—new versions of these protocols are released to address security vulnerabilities and add support for stronger, more secure encryption algorithm suites. The most commonly used term is “SSL/TLS certificate,” but a more precise name is “certificates for use with SSL and TLS.” This is because these protocols are determined by the server configuration rather than by the certificates themselves.

SSL and TSL

The SSL certificate was originally developed to enable the transmission of encrypted information between a server and end devices. The project was initiated in 1994 by Netscape. SSL certificates quickly gained popularity, among other reasons thanks to uncomplicated installation and ease of use. TLS was introduced in 1999 as a new version of SSL based on SSL 3.0: the purpose of this protocol is to provide three-level protection for data transmitted using HTTPS. TSL, in turn, is based on data integrity and protection against redirection to an unsafe website. The data is completely confidential, making it impossible to modify during transmission—any attempt by a third party to do so would be automatically detected.

SSL or TLS?

Over the years, many vulnerabilities have been discovered in outdated SSL protocols (e.g., POODLE, DROWN)—we described some attacks exploiting SSL vulnerabilities in one of our previous posts: “How to protect yourself against SSL attacks?” Both SSL 2.0 and 3.0 were deprecated by the IETF (in 2011 and 2015, respectively). Most modern browsers now block access to websites using these older protocols, for example by displaying an appropriate warning. Therefore, it is necessary to disable SSL 2.0 and 3.0 in the server configuration, leaving only TLS protocols enabled. Existing SSL certificates do not need to be replaced by TLS certificates because they are not dependent on the protocols. Theoretically, both SSL and TSL fit many cryptographic systems, but the same can be said for older versions such as SSL 2 and 3 or TLS 1.1, 1.2, or 1.3. The SSL and TLS protocols refer to the same overall concept, but there are differences between their versions—for instance, SSL 2 was not compatible with version 3, and SSL 3 was not compatible with TLS 1. Transport Layer Security (TLS) is essentially just the new name for SSL v4, which is almost the same protocol.

Security on the Internet

Implementing information encryption protocols brings numerous benefits, not only those related to increasing a website’s security. SSL and TSL are among the important ranking factors in Google’s algorithms, allowing websites to achieve higher positions in search results. Proper encryption of the internet connection also significantly increases a site’s credibility and prestige, which in turn boosts user trust. This can, for example, increase sales in an online store, making the use of SSL/TSL certificates practically indispensable for achieving success in online business.