What is Secure Sockets Layer?

Secure Sockets Layer, commonly known as SSL, is a standard security protocol for establishing encrypted links between a web server and a browser in an online communication. The usage of SSL technology ensures that all data transmitted between the web server and browser remains encrypted and therefore secure.

SSL is an industry standard and is used by millions of websites to protect their online transactions with their customers. If you have ever visited a website using the https:// in the address bar, that means your communication with the site is SSL protected.

History of SSL

The Secure Sockets Layer protocol was developed by Netscape Communications to secure communication over the internet. SSL version 1.0 was never publicly released due to serious security flaws. SSL version 2.0, released in 1995, was short-lived due to inherent weaknesses. SSL version 3.0, released in 1996, was a complete redesign of the protocol and is the basis for the Transport Layer Security (TLS) protocol, which is widely used today.

Over time, new versions of the protocols were released to address vulnerabilities and support stronger, more secure cipher suites and algorithms. Today, the term SSL is still used commonly but in practice, most have migrated to using TLS for secure internet communications.

Transition from SSL to TLS

Transport Layer Security (TLS) is the successor protocol to SSL. TLS is an updated version of SSL 3.0 and was released in 1999. It uses stronger cryptographic algorithms than its predecessor and has the ability to work on different ports. Additionally, it can be incorporated into a larger variety of applications.

The main difference between SSL and TLS is the way they handshake or establish the secure connection. SSL assumes that the connection is secure before it is made, while TLS continues to check the connection to ensure it is secure throughout the data transfer process.

How SSL Works

SSL operates through a combination of programs and encryption/decryption device at your server’s end. The programs manage the actual transaction, while the encryption/decryption device encodes and decodes each transaction.

SSL uses a combination of public-key and symmetric-key encryption to secure a connection between two machines, typically a web or mail server and a client machine, communicating over the internet or an internal network.

SSL Certificates

SSL certificates are small data files that digitally bind a cryptographic key to an organization’s details. When installed on a web server, it activates the padlock and the https protocol (over port 443) and allows secure connections from a web server to a browser.

SSL certificates bind together a domain name, server name or hostname and an organizational identity (i.e. company name) and location. An organization needs to install the SSL Certificate onto its web server to initiate secure sessions with browsers.

SSL Handshake

When a browser attempts to access a website that is secured by SSL, the browser and the web server establish an SSL connection using a process called an “SSL Handshake”. The handshake involves the generation of shared secrets to establish a uniquely secure connection between the client and the server.

The SSL Handshake is invisible to the user and happens instantaneously. The user can tell if their session is protected by SSL if their browser displays a padlock, and their address bar shows a URL beginning with https:// instead of http://.

Why SSL is Important

SSL is important for protecting your website, even if it doesn’t handle sensitive information like credit cards. It provides privacy, critical security and data integrity for both your websites and your users’ personal information.

SSL Encrypts Sensitive Information – The primary reason why SSL is used is to keep sensitive information sent across the Internet encrypted so that only the intended recipient can access it. This is important because the information you send on the Internet is passed from computer to computer to get to the destination server.

Data Integrity

SSL provides data integrity. Data integrity is the assurance that the information that is sent across the internet cannot be tampered with during transit. Without an SSL certificate, there is no guarantee that the information that you send or receive has not been intercepted and tampered with by a third party.

When data integrity is ensured, users can confidently send sensitive information such as credit card numbers, social security numbers, and login credentials over the internet. This is especially important for e-commerce websites, where users need to trust that their information will reach the intended server without being intercepted or altered.

Authentification

SSL provides authentication. This means you can be sure that you are sending information to the right server and not to an imposter trying to steal your information. The nature of the internet means that your customers will often be sending information through several computers. Any of these computers could pretend to be your website and trick your users into sending them personal information.

By getting an SSL certificate from a trusted SSL provider, you also get a trust seal that instills more trust in your customers. SSL providers will only issue an SSL certificate to a verified company that has gone through several identity checks.

Types of SSL Certificates

There are three types of SSL Certificate available today, Extended Validation (EV SSL), Organization Validated (OV SSL) and Domain Validated (DV SSL).

EV SSL Certificates provide the highest level of trust and assurance to your customers. The green address bar prominently displays your company name and provides highly visual assurance to customers that your site is secure, immediately giving them the confidence to complete their transaction.

Organization Validated SSL Certificates

OV SSL Certificates provide instant identity confirmation and strong SSL protection for your website and business. OV SSL is an organization validated certificate that gives your website a step up in credibility over domain validated SSL Certificates. It activates the padlock and https in your browser bar, and demonstrates to your users that your business is legitimate.

The organization validated certificate process includes authenticating the business behind the domain. This adds a higher level of security and lets customers know they can trust your server with their personal information.

Domain Validated SSL Certificates

Domain validated certificates are a fast and simple way to secure your website. DV SSL Certificates are fully automated which means you’ll be able to start protecting your e-commerce, logins, webmail and more in just a few minutes, 24/7.

Keywords like 128 bit, SSL secured, and others that denote high levels of security are present on these certificates. They show your customers that your site is secure and that they can buy with confidence.

Conclusion

Secure Sockets Layer (SSL) is a vital technology for securing internet connections, and protecting sensitive data from interception and tampering. It provides a secure channel between two machines operating over the internet or an internal network. In today’s internet age, the SSL protocol is typically used when a web browser needs to securely connect to a web server over the inherently insecure internet.

SSL and its successor, TLS, provide a way to encrypt a communication channel between two computers (e.g. your computer and the website’s server) or between two machines or devices. This is important because the information that you send over the Internet is passed from computer to computer to get to the destination server. SSL keeps this information encrypted and safe from potential attackers.