What is SSL/TLS encryption?

SSL and TLS: definition and difference

SSL (Secure Sockets Layer) was developed in the 1990s to secure connections on the internet. All SSL versions are now considered insecure. Its successor, TLS (Transport Layer Security), performs the same task; TLS 1.2 and TLS 1.3 are currently in use.

In everyday usage, however, the terms are used interchangeably: if you order an “SSL certificate,” you technically receive a certificate for TLS. HTTPS is simply the familiar web protocol HTTP, secured via TLS. Each certificate is valid for specific domains; so-called wildcard certificates additionally cover all subdomains at one level.

How SSL/TLS encryption works

When the connection is established—during the so-called handshake—the server identifies itself with a certificate. This certificate comes from a trusted certificate authority and confirms that the domain actually belongs to the server. The browser and server then negotiate a shared key that is used to encrypt all further data.

Asymmetric methods are used for the key exchange, and fast symmetric encryption for the actual data transfer. TLS 1.3 shortened the handshake and removed insecure methods—making connections faster and more secure.

• Confidentiality: third parties cannot read the transmitted data
• Integrity: tampering in transit is detected
• Authenticity: the certificate proves that visitors are connected to the genuine domain

Certificate types, benefits and limits

Domain-validated (DV) certificates only confirm control over the domain and are available free of charge, for example from Let’s Encrypt. Organization-validated (OV) and Extended Validation (EV) certificates also verify the company behind the domain. The strength of the encryption is the same for all types.

HTTPS is a must today: browsers flag unencrypted pages as “not secure,” and encrypted transmission is considered state of the art for forms that collect personal data. The limit: TLS only protects the transport route. A website with security vulnerabilities or a compromised server does not become any more secure because of the padlock icon.

In practice: what businesses should look out for

Certificates expire after a fixed period, and the maximum permitted validity is being shortened step by step. Automatic renewal is therefore essential—an expired certificate triggers warnings that scare visitors away. Monitoring flags problems in good time.

An example: a skilled trades business switches its website to HTTPS. All HTTP addresses are redirected to HTTPS via 301, embedded images and scripts are switched over, and HSTS is activated—a header that instructs browsers to connect only via encryption from then on. Old protocol versions are disabled. Nano Concepts sets up certificates, automatic renewal and a secure server configuration as part of hosting and maintenance. This article does not replace legal advice.