TLS vs SSL vs HTTPS: What’s the Difference? - Comodo SSL Resources (2024)

Loading...

Three data transfer protocols — Are they all the same, orare there differences?

TLS, SSL, HTTPS. TLS vs SSL. SSL vs HTTPS.

Acronym soup.

The world of website security acronyms canbe almost as annoying as that Deangelo Vickers character from the TV show “TheOffice” if you’re just getting to know about it. Although Deangelo Vickers willalways win this battle, in my opinion, at least we can turn him off and watchsomething else.

But when it comes to the acronyms and lingoof the cyber security industry, there’s no option but to learn suck it up andlearn them. So, let’s get started by talking about each and what the differenceis between SSL and HTTPS, and where TLS fits in.

SSL (Secure Sockets Layer): The Oldest of All

You might be aware that the internet, inits early days, was primarily used for military and research purposes. But,gradually, it expanded to common uses, and commercialization of the internetbegan. As a result, more and more users started sharing their sensitive informationwith businesses — personal data, financial information, etc. — and that createda need for protecting it.

Enter SSL.

SSL, which stands for secure sockets layer,is a cryptographic security protocol that protects your information as it transmitsacross the internet. A protocol basically means a set of rules that computersuse to communicate with each other. It’s kind of like their value system.

SSL was designed to thwart any unauthorizedthird party from intercepting and tampering with sensitive data while it’s intransit. SSL was developed and released by Netscape, and it was the first ofsuch cryptographic protocols. Its first version, SSL 1.0, never got released.SSL 2.0, the second version, was released in 1995.

The second version contained some securitydeficiencies, and as a result, SSL 3.0 was created. Later, this, too, was foundto have security flaws. This led to the creation of another acronym that youneed to know about: TLS, or what’s known as transport layer security. Before movingon to what TLS entails, it’s worth noting that SSL 2.0 & SSL 3.0 both havebeen deprecated and are no longer supported by web browsers due to the flaws intheir security.

TLS (Transport Layer Security): More Secure Version of SSL

Due to the recognized security flaws in SSL,security experts realized that a better and more secure protocol needed to bedeveloped. TLS 1.0 was a successor to SSL 3.0 and was first defined in 1999.Since then, three more versions of TLS have been released, with TLS 1.3 (whichwas released in 2018) being the most current.

TLS 1.0 and 1.1 are to be deprecated by Apple Safari, Google Chrome, Microsoft Edge and Internet Explorer, and Mozilla Firefox in early 2020.

How SSL/TLS is used in Certificates

As we saw earlier, SSL/TLS are protocolsthrough which communication takes place between two endpoints. Basically,they’re a set of rules that govern the data transmission between server andclient.

SSL/TLS certificates are X.509 digital files that are installed on a web server. It’s called a “certificate” because it’s issued by an independent third party that conducts verification of your website and organization.

SSL/TLS certificates work as part of a framework known as public key infrastructure (PKI). This involves the use of two keys — public and private keys. A public key, as the name suggests, is known to everyone. A private key, on the other hand, is kept by the server receiving the message.

Both the keys come are distinct, yetthey’re mathematically related to each other. Information encrypted by a publickey can only be decrypted by private key related to it. The entirecommunication happens under the rules decided by the protocol — SSL or TLS.

Now you might be wondering why, if SSL isno longer being used, it’s still referred to an SSL certificate and not a TLScertificate. Honestly, it’s just because industry language tends to be slow tochange. (Or the people in it are slow to change.) Either way, SSL is morecommonly used than TLS, so people tend to stick with using that terminology.

So, What is HTTPS?

Have you heard of HTTP (Hypertext TransferProtocol)? Well, if you haven’t, it’s the protocol that defines how messagesare formatted and transmitted. HTTPS is a secure version of HTTP because ituses SSL/TLS as a sublayer. When a website uses HTTPS in its web address, itindicates that any communication taking place between a browser and server is secure.In other words, if your website is using HTTPS, all the information will beencrypted by SSL/TLS certificates.

With all of this in mind, let’s compare TLSvs SSL vs HTTPS.

A Side-by-Side Comparison of TLS vs SSL vs HTTPS