Throughout our website here, we appear to use (or misuse) the terms SSL, TLS and HTTPS interchangeably, at random it seems.
From time to time we catch ourselves in the Monkey Treehouse ourselves and say, “Which one should we be using?”
Frankly, my default is to use SSL. When I reference an article or site, I do tend to side with the term it prefers. So what’s the difference?
Secure Sockets Layer (SSL)
Secure Sockets Layer (SSL) is a cryptographic protocol that enables secure communications over the Internet. SSL was originally developed by Netscape and released as SSL 2.0 in 1995. A much improved SSL 3.0 was released in 1996. Current browsers do not support SSL 2.0.
Transport Layer Security (TLS)
Transport Layer Security (TLS) is the successor to SSL. TLS 1.0 was defined in RFC 2246 in January 1999. The differences between TLS 1.0 and SSL 3.0 were significant enough that they did not interoperate. TLS 1.0 did allow the ability to downgrade the connection to SSL 3.0. TLS 1.1 (RFC 4346, April 2006) and TLS 1.2 (RFC 5246, August 2008) are the later editions in the TLS family. Current browsers support TLS 1.0 by default and may optionally support TLS 1.1 and 1.2.
Hypertext Transfer Protocol Secure (HTTPS)
Hypertext Transfer Protocol Secure (HTTPS), or “HTTP Secure,” is an application-specific implementation that is a combination of the Hypertext Transfer Protocol (HTTP) with the SSL/TLS. HTTPS is used to provide encrypted communication with and secure identification of a Web server.
In addition to HTTPS, SSL/TLS can be used to secure other application-specific protocols such as FTP, SMTP, NNTP and XMPP.
What terminology should we use?
Since TLS has succeeded SSL, logic dictates that we should be using the term TLS instead of SSL.
However, SSL is by far most common on the Internet, so SSL will probably continue to be our default acronym of choice when making non-application specific references.
From time to time, we will use SSL/TLS, which is probably what we will try to use in all documentation and proposals written down from now on.
When talking about HTTPS in conversation, we might use SSL, SSL/TLS or HTTPS, who knows?
