Secure Socket Layer (SSL)

Secure Sockets Layer (SSL) is an Internet security protocol that encrypts data to ensure secure communication between devices over a network.

• Developed by Netscape in 1995, SSL provides privacy, authentication and data integrity for online communications.
• It is the predecessor of TLS (Transport Layer Security), which is now the standard protocol for secure communications on the Internet.

Note: Websites using SSL/TLS display "HTTPS" in their URLs instead of "HTTP," indicating that communications are encrypted and secure.

Working of SSL

SSL ensures secure communication through three main mechanisms:

1. Encryption: Data transmitted over the network is encrypted, preventing unauthorized parties from reading it. If intercepted, encrypted data appears as an unreadable jumble of characters.
2. Authentication: SSL uses a handshake process to authenticate both the client and server, ensuring each party is legitimate and not an imposter.
3. Data Integrity: SSL digitally signs transmitted data to detect any tampering, ensuring that the data received is exactly what was sent.

Importance of SSL

Before SSL, web data was transmitted in plaintext, making it vulnerable to interception. SSL solves this by:

• Encrypting sensitive information such as login credentials, financial transactions and personal data.
• Authenticating web servers to prevent users from connecting to fraudulent websites.
• Ensuring data integrity so transmitted information cannot be modified during transit.

Note: SSL protects against cyber threats by providing confidentiality, authentication and integrity for online communications.

SSL Protocols

SSL consists of several protocols, each handling a different aspect of secure communication

1. SSL Record Protocol

• Provides confidentiality and message integrity.
• Application data is divided into fragments, optionally compressed and appended with a Message Authentication Code (MAC).
• The data is then encrypted and transmitted with an SSL header.

2. Handshake Protocol

Establishes SSL sessions and authenticates clients and servers.

Four phases:

• Client and server exchange hello packets, protocol versions and cipher suites.
• Server sends its certificate and server key information.
• Client responds with its certificate and key exchange.
• Change Cipher Spec finalizes the handshake, activating secure communication.

3. Change-Cipher Spec Protocol.

• Signals that pending cryptographic parameters from the handshake should now become active.
• Consists of a single 1-byte message.

4. Alert Protocol

• Communicates SSL-related warnings or errors.
• Warning alerts (level 1): Non-critical issues, such as expired or unsupported certificates.
• Fatal alerts (level 2): Critical errors, such as handshake failures, bad record MAC or illegal parameters, which terminate the connection.

Versions of SSL/TLS

Note: Today, TLS has replaced SSL, but the term "SSL" is still commonly used.

SSL Certificates

SSL certificates are digital certificates issued by trusted Certificate Authorities (CAs) to secure and verify websites.

Key Features

• Encryption: Protects sensitive information during transmission.
• Authentication: Confirms the identity of the website or service.
• Integrity: Ensures transmitted data is not altered.
• Non-repudiation: Prevents denial of transmitted messages.
• Public-key cryptography: Facilitates secure key exchange.
• Session management: Allows resumption of secure sessions after interruptions.

Types of SSL Certificates

1. Single-Domain: Secures one domain.
2. Wildcard: Secures one domain and all its subdomains.
3. Multi-Domain: Secures multiple unrelated domains in one certificate.

Validation Levels

• Domain Validation (DV): Confirms domain ownership.
• Organization Validation (OV): Confirms the organization's identity.
• Extended Validation (EV): Rigorous verification, highest trust level, often indicated by a green address bar.

SSL vs TLS

• SSL: Older protocol, no longer considered secure.
• TLS: Updated and more secure version of SSL.
• Despite TLS being the standard, the term "SSL" is still widely used in marketing and casual references.