Secure Socket Layer (SSL) provides security to the data that is transferred between web browser and server. SSL encrypts the link between a web server and a browser which ensures that all data passed between them remain private and free from attack.

SSL is the older version of what we now call TLS (Transport Layer Security). ****Websites using SSL/TLS have “HTTPS” in their URL instead of “HTTP.”

<aside> 💡  In 1999, the Internet Engineering Task Force (IETF) proposed an update to SSL. Since this update was developed by the IETF without Netscape’s involvement, the name was changed to TLS. The changes between the last version of SSL (3.0) and the first version of TLS were not significant; the name change mainly signified new ownership.

</aside>

How it works

• Encryption: SSL encrypts data transmitted over the web. If someone intercepts the data, they will only see a jumble of characters that is nearly impossible to decode.
• Authentication: SSL starts an authentication process called a handshake between two devices to confirm their identities, making sure both parties are who they claim to be.
• Data Integrity: SSL digitally signs data to ensure it hasn’t been tampered with, verifying that the data received is exactly what was sent by the sender.

Secure Socket Layer Protocols

• SSL Record Protocol
• Handshake Protocol
• Change-Cipher Spec Protocol
• Alert Protocol

SSL Record provides two services to SSL connection.

• Confidentiality
• Message Integrity

In the SSL Record Protocol, application data is divided into fragments. The fragment is compressed and then encrypted MAC (Message Authentication Code) generated by algorithms like SHA (Secure Hash Protocol) and MD5 (Message Digest) is appended. After encryption, the SSL header is appended to the data.

SSL Certificate

SSL certificate is a digital certificate used to secure and verify the identity of a website or an online service. The certificate is issued by a trusted third-party called a Certificate Authority (CA), who verifies the identity of the website or service before issuing the certificate.

SSL certificates can provide more security solutions than encryption, authentication, and integrity such as…

1. Public-key cryptography

SSL certificates use public-key cryptography for secure key exchange between the client and server. This allows the client and server to securely exchange encryption keys, ensuring that the encrypted information can only be decrypted by the intended recipient.

1. Non-repudiation

SSL certificates provide non-repudiation of data, meaning that the recipient of the data cannot deny having received it. This is important in situations where the authenticity of the information needs to be established, such as in e-commerce transactions.

1. Session management

SSL certificates allows for the management of secure sessions, giving the ability for resumption of secure sessions after interruption. This helps to reduce the overhead of establishing a new secure connection each time a user accesses a website or service.

1. Certificates issued by trusted CAs

SSL certificates are issued by trusted CAs, who are responsible for verifying the identity of the website or service before issuing the certificate. This provides a high level of trust and assurance to users that the website or service they are communicating with is authentic and trustworthy.