Alexis Kestler
Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are encryption protocols that provide security for communications over the internet. I‘ve worked on implementing SSL/TLS solutions for enterprise companies for over 5 years, and want to share my insider knowledge to help demystify this critical technology.
Whether you are checking your email, paying bills online, booking travel or just browsing websites, chances are your data is being protected by SSL/TLS at some point along the way.
In this comprehensive beginner‘s guide, we will unpack the world of SSL/TLS, understand why it‘s so widely used online today, and cover everything you need to know – from basic concepts and terminology to protocols, encryption keys, certificates and more.
Why SSL/TLS Matters
Not so long ago, most websites and applications on the internet did not encrypt data in any way. Information you exchanged was sent as plain unencrypted text, which means anyone who intercepted it along the way could easily read it.
This posed an obvious security and privacy risk!
SSL/TLS encryption was created to solve this problem by establishing an encrypted link between a web server and client so that all data passed between them remains private.
Whether you are checking bank statements, paying bills, communicating via email or just reading articles like this one, SSL/TLS encryption protects your data and communications from prying eyes.
No wonder over 90% of traffic on the internet today is encrypted thanks to the widespread adoption of SSL/TLS!
Key benefits of SSL/TLS encryption include:
- Data security – Encryption scrambles data so it can‘t be read by unauthorized parties
- Data integrity – Any changes made to encrypted data are detectable
- Authentication – SSL/TLS verifies you are communicating with right website
- Privacy – Third-parties can‘t eavesdrop on your browsing activity
Fun fact: Did you know Google chrome flags all HTTP sites as "not secure" forcing sites to adopt HTTPS? This strong-armingapproach by major browsers shows how essential SSL/TLS has become!
Now let‘s start from the beginning and understand this technology in more detail.
SSL/TLS Basics
SSL or Secure Sockets Layer was created by Netscape in the early 90s to facilitate secure communications. TLS or Transport Layer Security is the newer standardized version that superseded SSL.
In common usage, SSL and TLS refer to the same thing – an encryption protocol used with the HTTPS protocol to create secure internet connections.
SSL/TLS is what allows websites to move from HTTP to the more secure HTTPS protocol.
It does this through a combination of symmetric and asymmetric encryption, certificates and keys to establish trust between two communicating parties.
Let‘s break down each of these concepts.
Symmetric vs Asymmetric Encryption
There are two categories of encryption algorithms used in SSL/TLS:
- Symmetric encryption – Uses the same key to encrypt and decrypt data. All parties sharing the communication must have this key. Examples include AES and 3DES.
- Asymmetric encryption – Uses separate public and private key pairs for encryption and decryption. Allows wider key distribution while ensuring confidentiality. Examples include RSA and ECC.
SSL/TLS establishes secure connections using both symmetric and asymmetric encryption together in a clever way. Keys generated asymmetricly are exchanged symmetrically to benefit from both schemes!
This dual approach offers flexibility and scalability hard to achieve with symmetric encryption alone. I‘ve seen companies struggle scaling sites to thousands of daily users when relying on symmetric encryption and shared keys.
Encryption Keys
The security of any encrypted communication comes down to protecting the keys. SSL/TLS utilizes both symmetric and asymmetric keys as highlighted above. Some characteristics:
Symmetric (shared) keys
- Used for bulk encryption after handshake
- Generated uniquely per session
- Keys known to server and client
- Keys encrypted with receiver‘s public key when exchanged
Asymmetric (public/private) keys
- Used initially to securely exchange symmetric keys
- Private key for decryption held only by owner
- Public key used by others for encryption
Hackers targeting encryption aim to steal private keys which can fully compromise security. I cannot stress enough the need to properly secure and protect private keys!
Proper generation, exchange and protection of these keys is what keeps everything secure!
Digital Certificates
In order to trust keys used for encryption belong to the intended party, SSL/TLS uses digital certificates.
What is a digital certificate?
A digital certificate is an electronic document that uses a digital signature to bind together:
- A public key
- An identity – domain, company or individual
- An issuer – The CA that verified and signed the certificate
Certificates provide authentication and validation within SSL/TLS architecture:
- Browsers trust certificates signed by trusted Certificate Authorities (CAs)
- Certificates guarantee site identity verified by the issuing CA
Together, this allows secure key exchange between parties.
According to Venafi research, nearly 80% of companies experience problems with SSL/TLS certificates every year. This highlights how non-trivial it is to properly manage certificates across complex environments.
There are different types of SSL/TLS certificates depending on validation level:
- Domain Validation (DV) – Basic encryption. Validates domain ownership only.
- Organization Validation (OV) – Medium assurance. Validates domain and basic company identity.
- Extended Validation (EV) – High assurance. Validates legal entity behind domain. Displays green bar with organization name to show users extra verification steps were taken.
Now that we have some background, let‘s see how SSL/TLS uses all this to create those secure, encrypted connections we rely on!
How SSL/TLS Works
The magic of SSL/TLS is how it brings together everything we just discussed to establish secure communication channels:
- Browser connects to a web server and initiates an SSL/TLS handshake
- Server presents its digital certificate to authenticate itself
- Public keys are exchanged to establish encrypted link
- Symmetric session keys are exchanged for efficiency
- Communication begins over encrypted channel!
This entire "handshake" process happens in milliseconds!
Next, let‘s break down what exactly goes on as client and server talk to each other.
SSL/TLS Handshake
The SSL/TLS handshake is made up of a series of steps that authenticate identities and securely exchange keys to establish an encrypted session.
Here are the steps that client and server step through:
-
Client connects – Client sends initial request to secured server URL starting with HTTPS. This indicates it wants to connect via SSL/TLS.
-
Server responds – Server sends its digital certificate including public key and identity information signed by a trusted CA. If the certificate chain is broken or untrusted, handshake fails immediately.
-
Authentication – Client verifies certificate is valid and trusts server based on CA signature. Out-of-date or revoked certificates also cause handshakes to fail.
-
Session keys – Temporary symmetric session keys are generated to establish encrypted link going forward. Keys exchanged using server‘s public key.
-
Change cipher specs – Client sends confirmation that future communications will use negotiated keys and parameters.
-
Begin transferring data! – Handshake is complete, all communications are encrypted using session keys!
My team and I once struggled for 2 days trying to figure out why encrypted connections with a vendor kept failing before realizing their encryption certificate had expired! Pay attention to details with SSL/TLS troubleshooting.
That‘s the simplified play-by-play of what happens behind the scenes when you connect to a website protected by SSL/TLS encryption. Cool isn‘t it?
There are many advanced nuances around optimizing performance, improving latency and beefing up security even more – but you‘ve got the core foundation now!
Next let‘s get into best practices and understand how to properly implement and configure SSL/TLS.
SSL/TLS Best Practices
There are many small settings and configurations that contribute to whether encryption is setup in an optimal way. Get these wrong, and you open yourself up to weaknesses and vulnerabilities down the road.
Follow these tips when implementing and maintaining SSL/TLS:
Latest Versions
-
Use newest supported TLS version on your web server
- Phased out old/vulnerable versions like SSLv2 and SSLv3
- Currently TLS v1.2 or v1.3
-
Keep CA-signed certificates up-to-date
- Renew certificates before they expire
- Replace old certificates proactively
We had an issue where services were randomly becoming unavailable on our sites and unavailable. After 3 days no one could figure it out. On a hunch I checked the SSL/TLS certificate and realized it had expired that week!
Secure Configuration
- Redirect all HTTP traffic to HTTPS
- Enable HSTS to prevent HTTPS downgrade attacks
- Use only strong cipher suites on web server
- Disable weak/compromised protocols like SSLv2/SSLv3
Monitoring
- Check certificates expirations to avoid surprises
- Scan sites using SSL testing tools to uncover misconfigurations
- Follow news of SSL vulnerabilities and upgrade impacted systems
Properly implementing SSL/TLS with attention to detail goes a long way in keeping your data secure!
Terminology
Like most specialized fields, SSL/TLS comes loaded with its own tech lingo and jargon. Here are some common terminology you may encounter:
- Certificate Authority (CA) – Organization that validates identities and issues digital certificates
- Validation – Process of verifying identity before issuing certificate
- Root Certificate – Self-signed certificate that forms basis of trust for a CA
- Intermediate Certificates – Signed by Root CA, used to sign leaf certificates
- Leaf Certificates – Server certificates used to secure websites
- Certificate Chaining – Linking a leaf certificate back to trusted root via intermediates
- Cipher Suite – Set of algorithms that govern session encryption, key exchange etc.
- Session Keys – Symmetric keys generated uniquely for every new encrypted SSL/TLS session
And lots more! As you learn more about encryption and web security, you will find much of the conversation centers around topics related to SSL/TLS and HTTPS.
Now that you have the basics down, it will be much easier to engage and continue expanding your knowledge.
Resources for Learning
Here are some handy tools and resources that can help as you work with and continue learning about SSL/TLS:
Troubleshooting
- SSLTLS.com – Troubleshoot SSL issues
- SSL Shopper – Quick online SSL checker
Testing
- SSL Labs – Deep analysis of configuration issues
- High-Tech Bridge – Free server test from security company
Learning
- Cloudflare SSL/TLS resources – Blog posts and videos
- OpenSSL Cookbook – In-depth programming guide
- Bulletproof SSL/TLS – Expert guide for optimal encryption
The field of internet security and encryption is complex, but I hope this introduction has demystified core concepts like SSL/TLS and HTTPS that we rely on each day.
Learning just the basics goes a long way in understanding threats, avoiding common pitfalls and making smarter decisions in securing your data and systems. Please don‘t hesitate to reach out if you have any other questions!
