SSL/TLS encryption

SSL (now TLS) encrypts data between browser and server, visible as HTTPS. It combines asymmetric key exchange with fast symmetric encryption. HTTPS is a ranking signal and a must for shops; however, protection ends at the server.

SSL stands for Secure Sockets Layer and refers to an encryption protocol for secure data transmission on the internet. Strictly speaking, SSL is no longer used today: it has been replaced by its successor TLS (Transport Layer Security), currently in versions TLS 1.2 and TLS 1.3. However, the term “SSL” is so widespread that it is still used for both, for example in “SSL certificates”. TLS works in a hybrid way, i.e. with a combination of asymmetric and symmetric encryption: at the start of a connection, browser and server use asymmetric methods to negotiate a shared secret session key. This key is then used to encrypt all data quickly and symmetrically.

This hybrid method solves the so-called key distribution problem. Symmetric methods are very fast but require both sides to know the same secret key – which can't simply be transmitted unencrypted. Asymmetric methods solve this problem but are too slow for large amounts of data. TLS combines the advantages of both: the key exchange is secure, and the actual transmission is fast.

An SSL/TLS certificate prevents third parties from reading or altering transmitted data. The certificate also confirms that the connection really is to the specified domain. Both significantly increase IT security.

Position in the network

TLS sits between the transport layer (TCP) and applications such as the browser. The internet protocols themselves originally did not provide for encryption; TLS adds this security function. At its core, the protocol consists of two parts:

Record protocol (encryption and transmission of data)
Handshake protocol (establishing the connection and key exchange)

For applications, TLS is largely invisible: browsers and web servers handle encryption automatically without websites themselves having to be adapted.

SSL/TLS in practice

TLS is most commonly encountered with HTTPS, the encrypted version of HTTP – recognisable by the padlock symbol in the address bar. When a browser establishes a connection, the server identifies itself with its certificate, issued by a certificate authority. The browser checks the certificate, then the session key is agreed and the data transmitted in encrypted form. Certificates come in different validation levels; for most websites and shops, a domain-validated certificate is sufficient, which many hosting providers supply free of charge and automatically – for example via Let's Encrypt. For search engine optimisation, HTTPS is a must today: Google has treated it as a ranking signal since 2014, and browsers mark unencrypted pages as “not secure”. In online shops, where customers enter address and payment details, an encrypted connection is indispensable anyway.

It's important to note, however, that TLS protects transmission between two points, such as between browser and web server. If data is then forwarded – to other servers or services – this route must also be secured separately. In practice, security gaps usually arise not from the protocol itself but from outdated versions, incorrect configuration or insecure systems on the server side. Old protocols such as SSL 3.0, TLS 1.0 and TLS 1.1 are considered insecure and should be disabled.

What SSL/TLS doesn't protect

TLS secures transmission between visitor and server. A credit card number therefore can't be read during transmission. But encryption doesn't influence what happens to the data on the server afterwards. TLS protects neither against security gaps in the shop nor against improper handling of customer data. Even a fraudulent website can have a valid certificate – the padlock symbol only confirms the encrypted connection, not the trustworthiness of the provider.