What is SSL, TLS and HTTPS Hero

What is SSL, TLS & HTTPS?

How do they increase trust in websites? And how to look beyond the lock to know who's behind the website.

TLS/SSL

What is SSL and why is it important?

Secure Sockets Layer (SSL) certificates, sometimes called digital certificates, are used to establish an encrypted connection between a browser or user’s computer and a server or website.

UP NEXT
<   1  /  1  >
What Are SSL Blade1 Image

SSL: Secure Sockets Layer

SSL is standard technology for securing an internet connection by encrypting data sent between a website and a browser (or between two servers). It prevents hackers from seeing or stealing any information transferred, including personal or financial data.

Related terms

What Are SSL Blade2 Icon1

TLS: Transport Layer Security

TLS is an updated, more secure version of SSL. We still refer to our security certificates as SSL because it’s a more common term, but when you buy SSL from DigiCert, you get the most trusted, up-to-date TLS certificates.

What Are SSL Blade2 Icon2

HTTPS: Hyper Text Protocol Secure

HTTPS appears in the URL when a website is secured by an SSL/TLS certificate. Users can view the details of the certificate, including the issuing authority and the corporate name of the website owner, by clicking the lock symbol on the browser bar.

Why do you need SSL?

SSL isn’t just for ecommerce. It secures all types of information transferred to and from your website.

Checkout pages

Customers are more likely to complete a purchase if they know your checkout area (and the credit card info they share) is secure.

Login panels & forms

SSL encrypts and protects usernames and passwords, as well as forms used to submit personal information, documents or images.

Blogs & informational sites

Even blogs and websites that don’t collect payments or sensitive information need HTTPS to keep user activity private.

SSL improves SEO

In 2014, Google called for HTTPS everywhere to improve security across the web — and they rewarded SSL-secured sites with higher rankings. In 2018, Google went beyond search rankings and began punishing sites without SSL certificates by flagging them as “not secure” in the Chrome browser.

What Are SSL Blade5 Image

How does TLS/SSL increase trust?

Not all TLS/SSL certificates are created equal. Beyond encryption, TLS certificates also authenticate the identity of a website owner. This provides an added layer of security which users can see if they look beyond the lock. Certificates are offered with three levels of this identity verification:

  • Extended Validation SSL Certificates
    • Provides the highest level of identity assurance so users can feel safe on your website. That's why banks and trusted retailers use EV to let their customers know they're secure. Only EV certificates provide immediate assurances about the company or parent company that owns a website when users click on the lock.
  • Organization Validated SSL Certificates
    • Show customers you're serious about protecting your organization's brand. OV certificates are a mid-level option for websites that conduct business online. For certification, CAs require applicants to prove they own the domain name and that their organization is registered and legally accountable.
  • Domain Validated SSL Certificates
    • The most basic level of SSL certification, domain validation is the zero-identity certificate that only requires applicants to prove they control the domain name. DV certificates should only be used on non-commercial websites like blogs that don’t collect personal information from users.​
Beyond The Lock1 Image

Look beyond the lock

Just seeing a padlock in the address bar is no longer enough

By clicking on the padlock icon in the URL bar you can verify the identity of the website owner. Unfortunately, most phishing sites today have a padlock and a DV certificate. That's why it's important to look beyond the lock in the URL bar. If a website is not willing to put their identity in the certificate, you shouldn't be willing to share any identifying information with them. If you see the organization's name, now you can make a better decision about who you trust.

How do SSL certificates work?

SSL certificates establish an encrypted connection between a website/server and a browser with what’s known as an “SSL handshake.” For visitors to your website, the process is invisible — and instantaneous.

What Are SSL Blade6 Icon1

Authentication

For every new session a user begins on your website, their browser and your server exchange and validate each other’s SSL certificates.

What Are SSL Blade6 Icon2

Encryption

Your server shares its public key with the browser, which the browser then uses to create and encrypt a pre-master key. This is called the key exchange.

What Are SSL Blade6 Icon3

Decryption

The server decrypts the pre-master key with its private key, establishing a secure, encrypted connection used for the duration of the session.

 

 

Does SSL work on all devices & systems?

The short answer is yes. The long answer is that all major operating systems for
newer computers, tablets and mobile phones support SSL/TLS protocols. If you have
questions about the compatibility of older devices, contact our support team.

Browsers

Just as websites are designed to be device and browser agnostic, SSL/TLS is supported by all major web browsers.

Servers

An SSL certificate can be supported by any server. It’s up to the browser to determine the security of a server during the handshake process.

Email

Most cloud-based email providers use SSL encryption. Organizations can install an SSL certificate to protect private email servers.

What Are SSL Blade8 Image

Have questions about DigiCert Secure Site SSL certificates?

Check out our support center or call our award-winning support team for help: 1.801.701.9600

Get Support

SSL glossary

#

256-bit encryption

Process of scrambling an electronic document using an algorithm whose key is 256 bits in length. The longer the key, the stronger it is.

A

Asymmetric cryptography

Ciphers that imply a pair of two keys during the encryption and decryption processes. In the world of SSL and TLS, we call them public and private keys.

C

Certificate signing request (CSR)

Machine-readable form of a DigiCert certificate application. A CSR usually contains the public key and distinguished name of the requester.

Certificate authority (CA)

Entity authorized to issue, suspend, renew or revoke certificates under a CPS (Certification Practice Statement). CAs are identified by a distinguished name on all certificates and CRLs they issue. A CA must publicize its public key or provide a certificate from a higher-level CA attesting to the validity of its public key if it’s subordinate to a Primary Certification Authority. DigiCert is a Primary Certification Authority (PCA).

Cipher suite

A set of key exchange protocols, which includes the authentication, encryption and message authentication algorithms used within SSL protocols.

Common name (CN)

Attribute value within the distinguished name of a certificate. For SSL certificates, the common name is the DNS host name of the site to be secured. For Software Publisher Certificates, the common name is the organization name.

Connection error

Security issues preventing a secure session are flagged when a user tries to access a site.

D

Domain Validation (DV) SSL Certificates

The most basic level of SSL certificate. Only domain name ownership is validated before the certificate is issued.

E

Elliptic Curve Cryptography (ECC)

Creates encryption keys based on the idea of using points on a curve for the public/private key pair. Extremely difficult to break using the brute force methods often employed by hackers and offers a faster solution with less computing power than pure RSA chain encryption.

Encryption

Process of transforming readable (plaintext) data into an unintelligible form (ciphertext) so the original data either cannot be recovered (one-way encryption) or cannot be recovered without using an inverse decryption process (two-way encryption).

Extended Validation (EV) SSL Certificates

The most comprehensive form of secure certificate. The domain is validated and the company or organization undergoes a strict authentication process.

K

Key exchange

How users and servers securely establish a pre-master secret for a session.

L

Look beyond the lock

Our consumer education campaign about how to view high-assurance Extended Validation certificates. In order to combat the meteoric rise of phishing websites on the internet that pose as legitimate companies while using a legitimate Domain Validated certificate and therefore have the same padlock as other certificates.

 

M

Master secret

The key material used for a generation of encryption keys, MAC secrets and initialization vectors.

Message Authentication Code (MAC)

A one-way hash function arranged over a message and a secret.

O

Organization Validation (OV) SSL Certificates

A type of SSL certificate that validates ownership of the domain and the existence of the organization behind it.

P

Padlock

The icon found in the URL bar of most major browsers to signal a website is secured by HTTPS encryption. The padlock is only the first layer of a TLS/SSL certificate. If users click on the padlock icon, they can determine if a website has done its due diligence to keep customers safe online.

Pre-master secret

The key material used for the master secret derivation.

Public key infrastructure (PKI)

Architecture, organization, techniques, practices and procedures that collectively support the implementation and operation of a certificate-based public key cryptographic system. The PKI consists of systems that collaborate to provide and implement the public key cryptographic system, and possibly other related services.

S

Secure server

Server that protects host web pages using SSL or TLS. When a secure server is in use, the server is authenticated to the user. User information is encrypted by the web browser’s SSL protocol before being sent across the internet. Information can only be decrypted by the host site that requested it.

SAN (Subject Alternative Name) SSL certificates

Type of certificate that allows multiple domains to be secured with one SSL certificate.

SSL

Abbreviation for secure sockets layer. Protocol for web browsers and servers that allows for the authentication, encryption and decryption of data sent over the internet.

SSL certificate

Server certificate that enables authentication of the server to the user and encryption of data transferred between the server and the user.

SSL Handshake

A protocol used within SSL for the purpose of security negotiation.

Symmetric encryption

Encryption method that implies the same key is used both during the encryption and decryption processes.

T

TCP

Transmission control protocol, one of the main protocols in any network.

W

Wildcard SSL certificates

Type of certificate used to secure multiple subdomains.

  • DigiCert Logo

    The most-trusted global provider of high-assurance TLS/SSL, PKI, IoT and signing solutions.