Secure SSL/TLS protocol – how it works and how to use it

The use of the Internet for storing or transmitting payment and confidential data requires a reliable communication channel between the user’s computer and the web server. The creation of such a channel is possible thanks to encryption and authentication protocols, one of which is SSL/TLS. Let’s take a look at its main characteristics, capabilities, and principles of operation in practice.

General Information

SSL/TLS belongs to the class of cryptographic protocols that ensure secure data exchange between network participants based on cryptographic algorithms and transformations.

The SSL (Secure Sockets Layer) protocol was developed first. Its latest version — SSL 3.0 — was released in 1996, but within a few decades was considered outdated due to numerous vulnerabilities and architectural flaws.

Based on SSL 3.0, the TLS (Transport Layer Security) protocol was created, whose current version today is TLS 1.3. Although the abbreviation SSL is still widely used, technically, most modern implementations are based on TLS as a more secure variant.

The HTTPS protocol was developed on the basis of SSL; it “wraps” transmitted data in an encrypted SSL format. For HTTPS servers, the identifier of encryption use is port number 443 — this simplifies establishing a connection between the client and the server.

SSL serves as an intermediate layer between application protocols (HTTP, TELNET, FTP, etc.) and the transport layer, acting as a filter that protects data from interception or tampering.

Main Functions of SSL/TLS

Like any cryptographic protocol, SSL/TLS performs the following key tasks:

• Generation, exchange, and distribution of encryption keys;
• Authentication of the communicating parties;
• Ensuring data confidentiality and integrity;
• Maintaining the integrity of the connection itself.

To implement these functions, various cryptographic algorithms are used:

• for key management — Diffie-Hellman, SRP, ECDH, and the legacy RSA;
• for authentication — ECDSA, RSA, and others;
• for encryption — DES, RC4, AES;
• for data integrity verification — hash functions MD5 and SHA.

How a Secure Channel with the Server Is Established

Before a secure channel is established between the client and the server, a connection verification procedure takes place, known as the “handshake” (SSL Handshake). During this process, the parameters of the secure connection are agreed upon.
The client’s role is usually performed by the user’s browser connecting to a website. The process consists of several stages:

1. The client sends a request to establish a secure connection.
2. The server receives information about the cryptographic algorithms supported by the client.
3. The server selects from the proposed algorithms those it also supports and informs the client about this.
4. The server sends a digital certificate along with a public key required for authenticity verification.
5. The client verifies the received certificate by comparing it with trusted root certificates from certification authorities (CAs).
6. If the verification is successful, a shared session secret key is generated, which will be used to encrypt the session (for example, using RSA or Diffie-Hellman algorithms).

After the handshake procedure is completed, a secure connection is established between the client and the server, through which data is transmitted using symmetric encryption. The channel remains active until the connection is terminated.

If, for any reason, the parties fail to agree on the parameters, the connection will not be established, and the client will receive an error message.

Digital Certificates

To confirm the authenticity of the public key owner, SSL/TLS uses digital certificates.
They can be:

• self-signed (Self-Signed);
• issued by trusted certification authorities (CAs).

The type of certificate determines the level of owner verification. There are three main levels:

1. DV (Domain Validation) — only the domain is verified;
2. OV (Organization Validation) — both the domain and the organization are verified;
3. EV (Extended Validation) — the highest level of verification, with detailed owner identification.

To find out what type of certificate is used on a website, simply click the padlock icon to the left of the address bar in your browser.

The certificate level directly affects the degree of user trust in the website.
This is why banks and financial institutions typically use EV certificates, as they involve not only domain verification but also official verification of the owner’s identity — either a company or an individual. This greatly increases the website’s credibility.