Ministry of Land; Assistant Maintenance Engineer; Exam: 2023প্রশ্ন ও সমাধান

SSL (Secure Sockets Layer) was the original cryptographic protocol (1990s) for encrypting data between a client and server; all its versions (SSL 2.0, 3.0) are now considered insecure and deprecated due to known vulnerabilities (e.g., POODLE attack).

TLS (Transport Layer Security) is SSL's modern successor — it provides confidentiality (encryption), integrity (message authentication codes), and authentication (via certificates). TLS 1.2 and TLS 1.3 (current standard) are what actually secure connections today, even though the term "SSL" is still used colloquially.

HTTPS (HTTP Secure) = HTTP running over a TLS/SSL-encrypted channel (default port 443), protecting login credentials, payment data, and all other traffic from eavesdropping and tampering.

TLS handshake (simplified, TLS 1.2 style)

sequenceDiagram
  participant Client
  participant Server
  Client->>Server: ClientHello (supported ciphers, TLS version)
  Server-->>Client: ServerHello + Certificate + public key
  Client->>Client: Verify certificate against trusted CA
  Client->>Server: Encrypted pre-master secret (using server's public key)
  Server-->>Client: Finished (session key derived, encrypted channel ready)
  Client->>Server: GET /page (encrypted with session key)
  Server-->>Client: HTTP response (encrypted)

Term	Layer	Status
SSL 2.0/3.0	Session/Presentation	Deprecated, insecure
TLS 1.2 / 1.3	Session/Presentation	Current standard
HTTPS	Application (HTTP + TLS)	Standard for secure web traffic

Exam takeaway: "SSL" is now a legacy/informal name — actual secure web traffic runs on TLS, and HTTPS is simply HTTP transported over a TLS-encrypted connection using certificate-based authentication and a negotiated session key.