2

So confuse right now between SSLv3 and TLSv1.2, I tried to find some answer on the Web but didn't seems figure it out so I am asking you guys.

Is using the latest release of OpenSSL make me creating TLS certificate ? If yes, how can I verify this ? Is it possible to look into the certificate to find in wich version it was signed ?

Thanks

5

SSL and TLS are the same thing.

To be precise, SSL is the "old name": it means Secure Sockets Layer. It was the name of the protocol originally defined by Netscape. The last version of that protocol (SSL 3.0) has been later on published as RFC 6101.

In early 1999, the protocol was turned into an IETF standard, not something owned by a private corporation. This implied a change of name, both to symbolically assert the will to push the protocol into the public, implementable by anybody, and also to avoid intellectual property issues. The new name is Transport Layer Security, aka "TLS". This also expresses the idea that TLS can be applied to various transport channels, not just sockets.

So TLS 1.0 was published as RFC 2246. The authors took the opportunity to iron out a few historical quirks, meaning that TLS 1.0 is very similar, but not completely bit-to-bit equal, to SSL 3.0. Down on the wire, TLS 1.0 clients and servers actually announce the protocol version as "SSL 3.1".

As for the certificates, there is no difference. "SSL certificate" is the colloquial term for "a certificate that is fit for a SSL server". Such a certificate would work equally well for a TLS server, and vice versa. Certificates exist outside of SSL/TLS, and there is no notion of SSL/TLS protocol version which would apply to certificates. There is no place within a certificate where it would be written "this certificate is for SSL 3.0" or "this certificate is for TLS 1.0".

OpenSSL is called OpenSSL and not OpenTLS because it is a derivative of an older library called SSLeay, which was written years before the name change to TLS. A contrario, the GnuTLS library, a competitor to OpenSSL, was started after the name switch, and is sponsored by people who value naming correction over pedagogy (let's face it, the "SSL" acronym remains much more widely known and understood than "TLS").

  • 1
    Thanks, now I will separate x509 certs from the SSL/TLS protocol. I was in the idea of both are the same this as because using them all day long, sometimes you get confused. Also, I was able to find another answer of this question by using "Openssl s_connect" to specify the protocol to use (ex: openssl s_client -connect www.google.com:443 -tls1_2") and the returning values is telling me if TLS in valid or not. Thanks again !! – Philippe Massé Apr 29 '14 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.