Search code examples
securityssl

Difference between SSL & TLS


According to wikipedia: http://en.wikipedia.org/wiki/Transport_Layer_Security

Seems like TLS is a replacement to SSL, but most websites are still using SSL?


Solution

  • In short, TLSv1.0 is more or less SSLv3.1. You can find more details in this question on ServerFault.

    Most websites actually support both SSLv3 and TLSv1.0 at least, as this study indicates (Lee, Malkin, and Nahum's paper: Cryptographic Strength of SSL/TLS Servers: Current and Recent Practices, IMC 2007) (link obtained from the IETF TLS list). More than 98% support TLSv1+.

    I think the reason why SSLv3 is still in use was for legacy support (although most browsers support TLSv1 and some TLSv1.1 or even TLSv1.2 nowadays). Until not so long ago, some distributions still had SSLv2 (considered insecure) on by default along with the others.

    (You may also find this question interesting, although it's about the usage pattern of TLS rather than SSL vs. TLS (you could in fact have the same pattern with SSL). This does not apply to HTTPS anyway, since HTTPS uses SSL/TLS from the beginning of the connection.)