Secure Sockets Layer

Secure Sockets Layer
Name	Secure Sockets Layer
Developer	Netscape Communications Corporation
Introduced	1994
Deprecated	2015 (by major browsers and standards bodies)
Replaced by	Transport Layer Security

Secure Sockets Layer is a deprecated cryptographic protocol for securing communications over computer networks, originally developed by Netscape Communications Corporation and widely used for securing HTTP transactions, email protocols like SMTP, and other application protocols. It provided confidentiality, integrity, and authentication using a mix of symmetric cryptography, public key infrastructure, and message authentication, and influenced later standards developed by organizations such as the Internet Engineering Task Force and working groups convened by IETF-affiliated bodies. Implementation and deployment involved vendors and projects including Microsoft, Mozilla Foundation, Google, Apple Inc., and open-source projects like OpenSSL.

History

SSL originated at Netscape Communications Corporation in the mid-1990s during the rise of commercial World Wide Web services and online commerce spearheaded by companies such as Amazon (company), eBay, and Yahoo!. Early versions were rapidly iterated to respond to interoperability needs among implementations from Netscape Communications Corporation, Microsoft, and third-party libraries like SSLeay and OpenSSL. Standardization efforts and criticism from security researchers including Bruce Schneier, Phil Zimmermann, and teams at Cert Coordination Center influenced the migration to an IETF-managed protocol, culminating in the first versions of Transport Layer Security specified by working groups associated with IETF and contributors from RSA Security, Cisco Systems, and academic labs at institutions like MIT and Stanford University.

Protocol Overview

The protocol operated as a record layer encapsulating an alert protocol, handshake protocol, change-cipher-spec protocol, and application data protocol; it was layered beneath application protocols such as HTTP, FTP, SMTP, and NNTP. SSL used a handshake sequence that negotiated protocol version, cipher suite, session identifiers, and key material between endpoints including implementations in Netscape Navigator, Internet Explorer, Apache HTTP Server, and nginx. The handshake relied on X.509 certificates issued by certificate authorities such as VeriSign, DigiCert, Comodo Group, and roots maintained by platform vendors like Microsoft Corporation and Apple Inc. to authenticate servers and optionally clients. Session resumption, renegotiation, and features later scrutinized in standards discussions at IETF influenced how browsers and servers implemented session caching and tickets.

Cryptographic Components

SSL combined public-key algorithms like RSA (cryptosystem), key exchange methods influenced by Diffie–Hellman key exchange, and symmetric ciphers such as Data Encryption Standard and later Advanced Encryption Standard variants, alongside message authentication codes using algorithms related to MD5 and SHA-1. Certificate chains adhered to the X.509 standard used in infrastructures maintained by authorities including Entrust, GoDaddy, and government roots in jurisdictions like the United States and European Union member states. Cryptanalytic research from groups at Bell Labs, NTT, and universities including University of California, Berkeley and ETH Zurich exposed weaknesses in legacy cipher choices and hash functions, shaping recommendations by bodies such as NIST and the Internet Research Task Force.

Vulnerabilities and Deprecation

Several design and implementation weaknesses led to high-profile attacks and eventual deprecation. Notable incidents and research by teams at Royal Holloway University of London, Google Security Team, and independent researchers uncovered vulnerabilities including protocol downgrade attacks, the BEAST attack, the POODLE attack, and issues stemming from weak hash functions like MD5 and SHA-1. Implementations using flawed libraries such as early versions of OpenSSL and proprietary stacks in Microsoft Windows were exploited in campaigns attributed to groups investigated by entities like US-CERT and security firms including Mandiant and Kaspersky Lab. Standards bodies including IETF and organizations such as Mozilla Foundation and major vendors including Google and Apple Inc. moved to disable SSL in favor of updated protocols, and browser vendors removed support over time following recommendations from NIST and the CA/Browser Forum.

Implementations and Adoption

SSL was implemented in commercial products from Netscape Communications Corporation, Microsoft Corporation, Sun Microsystems, and IBM, and in open-source projects such as OpenSSL, GnuTLS, and NSS (software). Web servers like Apache HTTP Server and nginx provided SSL modules, and load balancers from F5 Networks and Citrix Systems supported SSL offloading. Content delivery networks like Akamai Technologies and cloud providers including Amazon Web Services, Google Cloud Platform, and Microsoft Azure offered SSL termination services. Adoption was driven by e-commerce platforms such as Amazon (company), financial institutions including JPMorgan Chase, and content platforms like YouTube and Facebook.

Security Best Practices

Best practices evolved from vendor guidance at Microsoft and Mozilla Foundation and standards from IETF and NIST, emphasizing strong cipher suites, forward secrecy via Ephemeral Diffie–Hellman, certificate pinning methods advocated by researchers at Google, timely revocation checking via OCSP and CRL mechanisms, and use of updated protocol versions specified by IETF working groups. Operators were advised to replace legacy ciphers like DES and weak hash algorithms such as MD5 with AES and SHA-256, to deploy HSTS policies promoted by Mozilla Foundation and Google, and to use automated issuance and renewal systems such as those spearheaded by initiatives like Let's Encrypt.

Legacy Compatibility and Transition to TLS

Migration efforts led by IETF working groups and major vendors facilitated transition from SSL to Transport Layer Security standards; vendors including Mozilla Foundation, Google, Microsoft Corporation, Apple Inc., and server projects like OpenSSL and GnuTLS removed or disabled SSL by default. Enterprises and service providers coordinated through industry forums such as the CA/Browser Forum and regulatory bodies in jurisdictions like the European Union and United States to deprecate legacy endpoints while maintaining compatibility for legacy clients in enterprise ecosystems including SAP and Oracle Corporation deployments. Tools and scanning projects from organizations like Qualys and Rapid7 assisted administrators in identifying legacy usage and completing migration plans.

Category:Cryptographic protocols