SSL Certificate Information Centre

The Secure Sockets Layer (SSL) (and Transport Layer Security (TLS)) is the most widely deployed security protocol used today.  It is essentially a protocol that provides a secure channel between two machines operating over the Internet or an internal network.  In today’s Internet focused world, we typically see SSL in use when a web browser needs to securely connect to a web server over the insecure Internet.  Technically SSL is a transparent protocol, which requires little interaction from the end user when establishing a secure session.  For example, in the case of a browser, users are alerted to the presence of SSL when the browser displays a padlock, or in the case of Extended Validation SSL the address bar displays both a padlock and a green bar.  This is the key to the success of SSL – it is incredibly simple experience for end users.

So in practice how is SSL used in today’s modern ecommerce enabled society?

• Web traffic such as credit card transactions.  In 2006 alone there were 210 million users online spending over $130 billion through their PCs / laptops / PDAs and mobile phones.  SSL *should* have been used to secure each and every one of these transactions!
• Other web traffic such as login pages, web forms, web mail, control panels or just protected areas of web sites.
• The transfer of files over https and FTP services such as web site owners updating new pages to their web sites.
• Email client to email server connections such as Microsoft Outlook to Microsoft Exchange.
• Intranet based traffic such as intranets, extranets and database connections.

All these applications have a number of shared themes:

• The data being transmitted over the Internet or network needs confidentiality, in other words, people do not want their credit card details to be exposed over the Internet.
• The data needs to remain integral, which means that once credit card details and the amount to be charged to the credit card have been sent, a hacker sitting in the middle cannot change the amount to be charged and where the funds should go.
• Your organization needs to assure your customers / extranet users that you are who you really say you are and not someone masquerading as you.
• Your organization needs to comply to regional, national or International regulations on data privacy, security and integrity.