TAGS
How SSL/TLS encryption works in web technology
Subh Singh
Invent the Future
Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols which provide secure communication between client web browsers and servers. It secure data sent over the internet by establishing an secure encrypted link between a client and a web server. TLS is the latest, upgraded and modern successor to the deprecated SSL, both terms are often used for the same purpose. Today, TLS is the modern standard protocol, while SSL is obsolete. But, people still commonly use the term SSL certificate even though it is actually a TLS certificate.
Secure Internet Communications
TLS is the new and latest cryptographic protocol to secure web based communications. It combines symmetric cryptography, asymmetric cryptography, and digital/hashing signatures. Together, these mechanisms ensure that data exchanged over protocols like HTTPS remains confidential, unmodified, and exchanged with the intended party.Why SSL/TLS is Required?
SSL/TLS provides three main security goals:- Confidentiality: Data is encrypted so unauthorized people cannot read it during communication.
- Integrity: Ensures data is not modified during transmission. TLS detects such modifications.
- Authentication: Confirms that you are communicating with the legitimate server. browser verifies desired certificate before trusting the connection.
Common SSL/TLS Attacks
- SSL Stripping
- Downgrade Attacks
- Man-in-the-Middle (MitM)
- Certificate Spoofing
- Weak Cipher Exploitation
- Expired or Misconfigured Certificates
Best Security Practices
- Use latest TLS 1.3 version (or TLS 1.2 if necessary).
- Disable old TLS 1.0, TLS 1.1, SSL 2.0 and SSL 3.0.
- Always, use trusted CAs certificates.
- HTTP Strict Transport Security (HSTS) should be Enable.
- Always strong cipher suites should be used.
- Ensure Perfect Forward Secrecy (PFS) is Enabled.
- Always, renew certificates before expire.
- Analyze certificate validity and revocation.