45

Since TLS is preferred over SSL, why do we still use the terms SSL and HTTPS generally?

The former could be anecdotal, but most people I speak to still say SSL in general conversation. The term HTTPS is more objective, since that means HTTP over SSL.

Why don't we say HTTPT (HTTP over TLS) and use the scheme httpt://?

Improve this question
10

3 Answers 3

Reset to default
77

Huge effort. Little technical return.

Introducing a new scheme (schemes are e.g. http://, https://, ftp://, etc.) and deploying it would mean breaking backwards compatibility. Not worth it.

Political rather than technical
Ivan Ristic devotes some sentences in the introduction to his book to this.

The book is called Bulletproof SSL and TLS. You've got both the "SSL" and "TLS" right in the title. (Go figure.)

The introductory chapter is free online. The naming controversy is mentioned in section "SSL versus TLS" (page xix) and section "Protocol History" (page 3).

It seems the whole reason for renaming from SSL to TLS was political rather than technical. Ristic's footnotes link to the blog of Tim Dierks. Dierks wrote the SSL 3.0 reference implementation in 1996 and this is his take on the naming:

  • Tim Dierks, 2014-05-23, Security Standards and Name Changes in the Browser Wars (archived here):

    As a part of the horsetrading, we had to make some changes to SSL 3.0 (so it wouldn't look [like] the IETF was just rubberstamping Netscape's protocol), and we had to rename the protocol (for the same reason). And thus was born TLS 1.0 (which was really SSL 3.1). And of course, now, in retrospect, the whole thing looks silly.

Further reading

  • Here's another take on the naming. It's by Mike McCana (who operates a CA himself):
    Mike McCana, CertSimple.com blog, 2016-01-05, Why do we still say SSL? (Archived here.)
Improve this answer
4
  • 1
    Thanks for your excellent answer. Gets right to the heart of the issue.
    – Ian Newson
    Commented Jun 24, 2015 at 15:38
  • If anyone cared enough, I guess a cheap way to fix this would be to call TLS 1.3 SSL 4, or similar. I'm guessing the political landscape of the 90s is no longer an issue.
    – Ian Newson
    Commented Jun 24, 2015 at 15:40
  • 3
    I'd simply add that it doesn't really matter if we call it SSL, TLS, RTS, FPS, SSS, STP, STS, or any other three letter acronym (some I think are rather clever and less dry than official names, too bad I'll forget them in 30 minutes). All non-techies care about is the S-- security. They want A (themselves) to speak with B (someone else) without C (a Bad person) getting in the middle.
    – phyrfox
    Commented Jun 24, 2015 at 17:27
  • 7
    @phyrfox Maybe call it the AB!C protocol then.
    – lkraider
    Commented Jun 25, 2015 at 4:14
12

Why don't we say HTTPT (HTTP over TLS) and use the scheme httpt://?

Because it would be a waste of time and money to change everything without effectively gaining anything?

Improve this answer
10
  • 4
    I don't think it's right to say nothing is gained, as inconsistency costs time. It would be fair to say that not enough is gained though, or in other words the cost/benefit ratio doesn't justify it. I realise I'm splitting hairs!
    – Ian Newson
    Commented Jun 24, 2015 at 13:18
  • 1
    How this question can answer the question? Can you prove that adding a protocol would be a waste of time and money? (I'm splitting hairs too)
    – A.L
    Commented Jun 24, 2015 at 14:04
  • @A.L: I considered it obvious that it would take considerable resources to rename something which is hard-wired into millions of devices and software and is written into documentation, books etc. And the net effect is just the renaming.
    – Steffen Ullrich
    Commented Jun 24, 2015 at 14:21
  • 4
    @IanNewson: TLS is just another word for SSL, in fact TLS 1.0 is protocol SSL 3.1 etc. It would be much cheaper to teach this fact than to rename everything.
    – Steffen Ullrich
    Commented Jun 24, 2015 at 14:23
  • 2
    I think people are ignoring the actual answer. the 's' means secure so the encryption you use to do so doesn't matter. TLS, SSL etc are all separate encryption methods to create a secure protocol. Why would you ever change your URL scheme to reflect your encryption key name? The fact that one exists is why the 's' is there in the first place.
    – Ben Racicot
    Commented Jun 25, 2015 at 14:19
4

Mostly tradition. People have been using "SSL" to refer to encrypted communications for so long that even though the protocols called SSL have all been replaced, the name has stuck around.

As for why we don't call it HTTPT, a big part of the reason is that Cool URLs Don't Change. A huge number of links in existing Web pages would break, and many of them would likely never be updated. As depressing as it can sound, we cannot count on users to understand how to convert these into HTTPT links, even though it might mean changing only one character.

Besides, Berkeley Breathed and the authors of ack might get mad.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .