{"id":2413,"date":"2018-03-16T06:11:41","date_gmt":"2018-03-16T10:11:41","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=1858"},"modified":"2020-08-25T09:11:36","modified_gmt":"2020-08-25T13:11:36","slug":"the-real-truth-about-tls-vs-ssl-the-difference-may-surprise-you","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/the-real-truth-about-tls-vs-ssl-the-difference-may-surprise-you\/","title":{"rendered":"Re-Hashed: The Real Truth About TLS Vs SSL- The Difference May Surprise You!"},"content":{"rendered":"

TLS vs SSL – Similar intentions, different means<\/h2>\n

When you are researching SSL Certificates, or if you already work with SSL (Secure Sockets Layer) to secure your online business, websites or any communication, you may come across another secure communications protocols: TLS (Transport Layer Security) and might be wondering about ‘TLS vs SSL.’<\/p>\n

The majority of people who are connected with online business know SSL provides a secured, encrypted communication between a client and a server. But you may be wondering what TLS is, and scratching your head about the difference.<\/span><\/p>\n

\"PCI<\/p>\n

Luckily, the truth is simple. TLS is simply a newer version of SSL. TLS was first introduced in 1999 as an upgrade to SSL Version 3.0 and was written by Christopher Allen and Tim Dierks. As stated in their original paper, “the differences between this protocol and SSL 3.0 are not dramatic, but they are significant enough to preclude interoperability between TLS 1.0 and SSL 3.0”.<\/p>\n

So in reality when you are talking about SSL today, you should really be saying TLS instead. However, the majority of people still say SSL instead of TLS and that\u2019s why all major brands likes Symantec, Thawte, Comodo, and GeoTrust didn\u2019t change the names of their products from SSL Certificates to TLS certificates. Likewise, this is why software that enables SSL on a server, such as OpenSSL, didn\u2019t change its name to OpenTLS.<\/p>\n

The certificates themselves have been expanded over time to support all the versions of SSL and TLS, so you don\u2019t need to worry that you may be buying an incompatible certificate.<\/p>\n<\/span>\n

Is SSL itself really dead?<\/strong><\/h2>\n

No, not completely. However it should be. Let\u2019s explain\u2026<\/p>\n

Overall there are 5 different versions of SSL and TLS. They each made improvements on the version before it. However, not all computers and servers support all 5 versions, so a key part of setting up a secure connection is having the client and server agree on which protocol to use. When the client establishes the connection with the server there is a process called a \u201chandshake<\/a>\u201d where the client and server choose the protocol version. In some cases a lack of mutual support will result in them using an older protocol, such as SSL 3.0. This is actually dangerous, too. SSL 3.0 has been proven vulnerable. It should be universally deprecated. Most platforms have already done this, but every now and then in the dark corners of the web you’ll still find SSL 3.0.<\/p>\n

While we still talk about SSL and TLS as if they are the same, there are major technical differences between the newest version of TLS (which is Version 1.3) and the last version of SSL that was released (which was SSL 3.0). Again, this is why using SSL 3.0 today can be dangerous.<\/p>\n

Most devices now support TLS, however there is a way to force a connection to use the older and insecure SSL versions known as a \u201cdowngrade attack\u201d. Unfortunately, SSL 3.0 has weaknesses that hackers can exploit, giving them the incentive to try to force servers to downgrade to SSL 3.0<\/p>\n

That being said \u2013 you shouldn\u2019t worry too much. Supporting the most modern, secure versions of SSL is simply a matter of updating your server configuration. All SSL Certificates are capable of using any protocol version of SSL or TLS \u2013 so that\u2019s not something you need to worry about when shopping for a certificate.<\/p>\n

How can old versions of the SSL protocol be used to weaken Internet security?<\/strong><\/h2>\n

In 2014, researchers at Google disclosed the \u2018POODLE\u2019 vulnerability, which could allow attackers to decrypt encrypted connections to websites that use the SSL 3.0 protocol using a \u201cman in the middle\u201d attack \u2013 a popular way to intercept data.<\/p>\n

This is where the hacker inserts a process in between the client and server through which their communication passes through, allowing the hacker to listen in on a private communication. The hacker may also be able to redirect the client to a web site controlled by the hacker where the hacker will infect the client with malware and\/or commit financial fraud.<\/p>\n

The \u2018Coffee shop\u201d attack is the perfect example of a \u201cMan in the Middle\u201d attack. In this case, a hacker is sitting in the coffee shop, and has set up a laptop to broadcast a WiFi signal that looks the same as the \u201cCoffee Shop\u2019s WiFi.\u201d The victim then carelessly connects to the hacker\u2019s WiFi signal instead of the Coffer Shop WiFi and all of the victim\u2019s traffic is subsequently available to the attacker to intercept and record. This type of attack would usually be stopped if the connection was encrypted. However, with the POODLE vulnerability, it would be theoretically possible to decrypt some data from sessions that are secured with SSL 3.0.<\/p>\n

Fortunately, there is a simple solution: SSL 3.0 can be disabled on a server and\/or in the client\u2019s browser. If either party does not support the insecure version, there is no way to \u201cfall back\u201d to SSL or execute the attack.<\/p>\n

You can check to see if a web site has SSL 3.0 enabled as follows: Enter your website URL at: <\/strong>
\nhttps:\/\/sslanalyzer.comodoca.com<\/a>. Sites with SSL 3.0 will be reported as \u2018Vulnerable to the POODLE attack.\u2019<\/p>\n

Note: <\/strong>Re-Hashed is a feature on Hashed Out where we take an older article and touch it up so that our new readers can enjoy it, too. This article originally ran on August 24, 2015. It has been updated and revised by Jay Thakkar.<\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

TLS vs SSL – Similar intentions, different means When you are researching SSL Certificates, or if you already work with SSL (Secure Sockets Layer) to secure your online business, websites…<\/p>\n","protected":false},"author":10,"featured_media":6066,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[130],"tags":[],"class_list":["post-2413","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-everything-encryption","post-without-tags"],"views":35548,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2015\/08\/iStock-690642900.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=2413"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2413\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/6066"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=2413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=2413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=2413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}