Secure Sockets Layer

SecureSocketsLayer (SSL) protocol is used in most secured websites, especially where financial transactions are involved.

It is commonly used in browsers as a layer7 access mechanism through TCP port 443, although it is by no means limited to this.

A server certificate is needed from a certificate authority (e.g. Verisign), through a tedious Certificate Signing Request (CSR) process.

Typically asymmetric encryption mode is used for securing messages and a process exists to protect the key necessary to decrypt a secured message.

SSLv2 is still around but it is being phased out.

SSLv3 (or TLS) enables two-way roundtrip authentication. This is done by the client presenting a signed certificate to the web server, in addition to the certificate presented by the server to the client.

Applicability

It is said this is a superior mehanism for securing client-server WebApplications, because often pre-configured certificates on servers suffice without need for using client side certificates. This has simplified administration of InformationSecurity. See article in PublicKeyInfrastructure WebServices for details.

Readings material

CategorySecurity, CategoryEnterpriseComputingConcerns, CategoryWebDesign