SSL

SSL, or Secure Sockets Layer, is a cryptographic protocol used to secure communications over a computer network. It provides confidentiality, integrity, and authentication between two parties, typically a client and a server. SSL relies on a combination of asymmetric cryptography for the initial key exchange, symmetric encryption for the data stream, and a message authentication code to detect tampering. Servers are authenticated with X.509 certificates issued by trusted authorities.

SSL was developed by Netscape in the mid-1990s. Early versions, SSL 2.0 and SSL 3.0, contained security flaws and are now deprecated. The protocol family evolved into Transport Layer Security (TLS), standardized by the IETF. TLS, rather than SSL, is the basis for securing most modern communications.

Operation begins with a handshake in which the client and server negotiate the protocol version and cipher suite, exchange certificates, and perform a key exchange to establish shared session keys. The session then uses symmetric encryption such as AES or ChaCha20-Poly1305 and a MAC or AEAD to ensure data integrity. Modern configurations favor forward secrecy through ephemeral key exchange (for example, ECDHE) and strong cipher suites. The resulting secure channel is commonly used to protect HTTPS traffic.

Impact and use: SSL/TLS underpins secure web traffic, email, and many other services. Certificates bind public keys to identities and are issued by trusted certificate authorities. Proper configuration and maintenance, such as using current TLS versions, valid certificates, and security headers, reduce risks from protocol flaws and misconfigurations.