SSL (Secure Sockets Layer) is a cryptographic security protocol designed to protect data exchanged over a network. It was developed by Netscape Communications in the mid-1990s for the Netscape Navigator web browser. SSL was later used more broadly for applications such as instant messaging, VoIP calls, and email.
Because of its widespread adoption and security features, SSL was also used as a basis for VPN technologies, particularly SSL VPNs, which emerged as an alternative to IPsec-based VPNs.
SSL uses asymmetric cryptography for authentication and secure key exchange, symmetric encryption to protect the confidentiality of transmitted data, and message authentication codes (MACs) to provide data integrity.
Advantages of SSL
One of the advantages of SSL is that it operates independently of the application-layer protocol. HTTP, FTP, Telnet, and other application protocols can operate over an SSL-protected connection. SSL establishes the secure channel before the application begins exchanging protected data.
Other advantages include:
- does not necessarily require additional client software when used through a web browser;
- was supported on a wide range of devices, including computers and mobile phones, as well as operating systems such as Windows, macOS, Unix, and Linux;
- provided a strong level of security for its time.
Disadvantages of SSL
- limited support for newer and more complex web technologies in older SSL-based VPN implementations;
- limited support for general-purpose Windows software when SSL VPNs were implemented primarily through web browsers;
- browser-oriented SSL VPN implementations could not always provide full system-wide VPN functionality. In such configurations, only browser-based applications could use the protected connection, while other programs on Windows, Unix, Linux, IBM i, and other platforms continued to use the regular network connection;
- limited scope of protection in some browser-based implementations. When SSL is used to protect a connection through a web browser, only the traffic carried through that SSL connection is encrypted. Other traffic generated by the user's device remains outside the protected channel.
In 2014, a serious vulnerability known as POODLE was discovered in SSL 3.0. As a result, SSL 3.0 was deprecated, and the Internet community moved to its successor, TLS, which provides improved security. Today, the term "SSL" is still sometimes used informally to refer to modern TLS connections, but SSL itself is obsolete and should no longer be used.