What is SSL?

SSL (Secure Sockets Layer) and its successor, TLS (Transport Layer Security) are protocols for establishing authenticated and encrypted links between networked computers. Although the SSL protocol was deprecated with the release of TLS 1.0 in 1999, it is still common to refer to these related technologies as “SSL” or “SSL/TLS.” An SSL certificate (also known as a TLS or SSL/TLS certificate) is a digital document that binds the identity of a website to a cryptographic key pair consisting of a public key and a private key. The public key, included in the certificate, allows a web browser to initiate an encrypted communication session with a web server via the TLS and HTTPS protocols. The private key is kept secure on the server, and is used to digitally sign web pages and other documents (such as images and JavaScript files). An SSL certificate also includes identifying information about a website, including its domain name and, optionally, identifying information about the site’s owner. If the web server’s SSL certificate is signed by a publicly trusted certificate authority (CA), like SSL.com , digitally signed content from the server will be trusted by end users’ web browsers and operating systems as authentic. What is TLS? TLS (Transport Layer Security) released in 1999, is the successor to the SSL (Secure Sockets Layer) protocol for authentication and encryption. TLS 1.3 is defined in in RFC 8446 (August 2018). Do I need a dedicated IP address to use SSL/TLS? At one time it was a mandatory requirement to have a dedicated IP for each SSL certificate on a web server. This is no longer the case due to a technology called Server Name Indication (SNI). Your hosting platform will specifically have to support SNI. You can find out more information about SNI in this SSL.com article

What port is recommended to use SSL/TLS over? For maximum compatibility, port 443 is the standard, thus recommended, port used for secured SSL/TLS communications. However, any port can be used. What is the current version of SSL/TLS? TLS 1.3, defined in August 2018 by RFC 8446 is the most recent version of SSL/TLS. TLS 1.2 (RFC 5246) was defined in August 2008 and also remains in wide use. Versions of SSL/TLS prior to TLS 1.2 are considered insecure and should no longer be used. What are the security issues with older versions of TLS? TLS versions 1.0 and 1.1 are affected by a large number of protocol and implementation vulnerabilities that have been published by security researchers in the last two decades. Attacks like ROBOT affected the RSA key exchange algorithm, while LogJam and WeakDH showed that many TLS servers could be tricked into using incorrect parameters for other key exchange methods. Compromising a key exchange allows attackers to completely compromise network security and decrypt conversations. Attacks on symmetric ciphers, such as BEAST or Lucky13 have demonstrated that various ciphers supported in TLS 1.2 and earlier, with examples including RC4 or CBC-mode ciphers, are not secure. Even signatures were affected, with Bleichenbacher’s RSA signature forgery attack and other similar padding attacks. Most of these attacks have been mitigated in TLS 1.2 (provided that TLS instances are configured correctly), even though TLS 1.2 is still vulnerable to downgrade attacks such as POODLE FREAK or CurveSwap This is due to the fact that all versions of the TLS protocol prior to 1.3 don’t protect the handshake negotiation (which decides the protocol version that will be used throughout the exchange). OpenSSL OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites. OpenSSL contains an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements basic cryptographic functions and provides various utility functions. Wrappers allowing the use of the OpenSSL library in a variety of computer languages are available. The OpenSSL Software Foundation (OSF) represents the OpenSSL project in most legal capacities including contributor license agreements, managing donations, and so on. OpenSSL Software Services (OSS) also represents the OpenSSL project, for Support Contracts. OpenSSL is available for most Unix-like operating systems (including Linux, macOS, and BSD) and Microsoft Windows.