SSL/TLS Connections

SSL and TLS both refer to connections that use the server's public key to establish an agreed upon communication session that is then used by both the client and the server to encrypt all data that is exchanged back and forth. Often these terms are confused and used synonymously to describe the secure connection between client and server. Since TLS uses stronger encryption, it is actually preferred over SSL. All modern browsers support both SSL and TLS, as do almost all web sites on the internet today. Since TLS is more secure, it is used more prevalently. However, since TLS is an extension of SSL, it is often referred to as an SSL connection, when the actual implementation is TLS.

A good example of a website that uses SSL/TLS connections is your bank's website. To ensure that your personal information is not available to other parties on the internet, the website requires that you connect securely (https). When you connect to the bank's website, the bank presents its certificate to your web browser. As long as the certificate is issued by a certificate authority that your browser trusts, the connection is allowed without warning and you can then use the bank's website to access your account information by entering your username and password and other forms of authentication to verify your identity.

The diagram below shows that only the bank must have a certificate and private key loaded into its certificate store in order for the connection to work. The client does not need a certificate and private key to communicate securely with a standard SSL/TLS connection.