{"id":4971,"date":"2019-01-17T23:23:00","date_gmt":"2019-01-17T23:23:00","guid":{"rendered":"https:\/\/www.n-able.com\/?p=4971"},"modified":"2021-05-06T13:34:09","modified_gmt":"2021-05-06T12:34:09","slug":"tls-vs-ssl-whats-difference","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/tls-vs-ssl-whats-difference","title":{"rendered":"TLS vs SSL: What’s the Difference?"},"content":{"rendered":"

When it comes to internet security, TLS vs SSL is an important topic of conversation. The problem is that many people get confused between the two and don\u2019t understand the difference between TLS and SSL. So what are they and how do they work? This article sets out to help you find your way through the maze.<\/p>\n

What is the difference between TLS and SSL?<\/b><\/h3>\n

\"\"Transport Layer Security (TLS) and Secure Socket Layers (SSL) are protocols that provide authentication and encryption when you are transferring data between devices on a network or webserver. TLS is now considered the standard for authentication, with serious vulnerabilities having been brought to light in SSL during the early 2000s following a number of high-profile exploits.<\/p>\n

The protocols are different, but the confusion for many people comes in the fact that the terms TLS and SSL are used interchangeably. People say SSL when they actually mean TLS. Today, TLS is the encryption standard that everyone uses, and is most often used alongside other internet protocols such as HTTPS, SSH, FTPS, and\u00a0secure email<\/a>.<\/p>\n

When it comes to looking at TLS vs SSL, it\u2019s important to understand that SSL is the older protocol. It was developed by Netscape and was first seen in 1995, after which it went through a rapid progression as a number of vulnerabilities were found in the early versions\u2014it had reached version 3.0 (SSLv3) by 1996. Meanwhile TLS appeared on the scene in 1999 as a new\u2014more secure\u2014version of SSL based on SSLv3.<\/p>\n

What is POODLE attack?<\/b><\/h3>\n

In 2004, the\u00a0POODLE (Padding Oracle On Downgraded Legacy Encryption) attack\u00a0crept in under the radar and rendered SSLv3 dangerously insecure.<\/p>\n

The attack targeted browsers that relied on SSLv3 for encryption and authentication. Although TLS was widely used at the time, many browsers would default to SSLv3 if a TLS connection was unavailable. An attacker could break into a communication session and force the browser to use SSLv3. From here they were able to take advantage of a design flaw in SSLv3 which meant that padding data at the end of a block cipher could be changed so that the encryption cipher became less secure each time it was passed between devices.<\/p>\n

To prevent the attack, administrators needed to check that their server software supported the latest version of TLS and that is was correctly configured.<\/p>\n

How does TLS work?<\/b><\/h3>\n

In essence TLS consists of two parts:<\/p>\n

    \n
  1. The handshake layer. This is performed only once to establish a secure connection. It controls the type of encryption algorithm that is used as well as the authentication process and the key exchange.<\/li>\n
  2. The record layer. This takes the data to be transferred and then encrypts it and breaks it into chunks that are determined by the encryption algorithm before sending it to the network transport layer.<\/li>\n<\/ol>\n

    Is SSL or TLS more secure?<\/b><\/h3>\n

    Originally TLS v1 was touted as being only slightly more secure than SSLv3. Today, SSLv3 is considered dated and attacks such as the\u00a0POODLE<\/a>\u00a0vulnerability (as explained above) have shown it to be critically insecure.<\/p>\n

    The discovery of POODLE led directly to SSLv3 being disabled for websites and services globally. This has effectively rendered it dead as a security protocol. So, if you haven\u2019t disabled it already you should make sure you take steps to remove it as soon as possible. If you don\u2019t know whether your site still uses SSLv3 you can check using this free tool:\u00a0https:\/\/www.ssllabs.com\/ssltest\/<\/a><\/p>\n

    More recent iterations of TLS\u2014v1.1, v1.2, and v1.3\u2014have addressed many of the vulnerabilities in SSLv3 and TLSv1. Indeed, many believe it is now time to also ensure that any instances of TLSv1 have been deactivated. Use of TLSv1 by websites accepting credit cards or services used by the US Government had to stop by 30th June 2018. Instead, they must now use a minimum of TLSv1.1, with TLSv1.2 or higher being strongly recommended.<\/p>\n

    Regardless of this, there are many sites out there using old or insecure versions of SSL. You can see the figures changing on a daily basis at\u00a0https:\/\/www.ssllabs.com\/ssl-pulse\/<\/a><\/p>\n

    Why should you be using SSL\/TLS protocols at all?<\/b><\/h3>\n

    \"\"There are two important ways your site will benefit from using encryption to protect sensitive data.<\/p>\n

    First, it will prevent intruders (whether malicious hackers or benign sources like ISPs or ad networks) from tampering with communications between your website and web browsers. Second, you can prevent intruders from passively listening to communications with your server.<\/p>\n

    The importance of these should not be underestimated, especially for sites that need to build user trust, such as ecommerce sites where credit card data is being handled.<\/p>\n

    However, SSL\/TLS protocols are not without their drawbacks.<\/p>\n

    TLS can slow your site down. The handshake is resource-hungry, as it uses asymmetric encryption to establish a session key. It also adds complexity to your server management as you have to get an SSL certificate installed on your web server and maintain the validity of that certificate.<\/p>\n

    An SSL certificate is a small data file that is installed on your web server and links a\u00a0cryptographic key\u00a0to your organization\u2019s details (including the name of the holder, serial number and expiration date, a copy of the certificate holder\u2019s public key, and the digital signature of the certificate-issuing authority). This allows a secure connection to be made from a web server to a browser.<\/p>\n

    However, discussing pros and cons is becoming irrelevant as Google has now cracked down on\u00a0website security. All websites with text input fields must have an SSL certificate or Google now flags website as not secure with a red caution sign next to their URL.<\/p>\n

    What are the different types of SSL certificate?<\/b><\/h3>\n

    There are three main types of SSL certificates that offer different levels of trustworthiness and range in price and complexity. These include:<\/p>\n