Since TLS is preferred over SSL, why do we still use the terms SSL and HTTPS generally?

The former could be anecdotal, but most people I speak to still say SSL in general conversation. The term HTTPS is more objective, since that means HTTP over SSL.

Why don't we say HTTPT (HTTP over TLS) and use the scheme httpt://?

closed as primarily opinion-based by Stephane, schroeder, Eric G, Steffen Ullrich, D.W. Jun 26 '15 at 5:30

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 74 down vote accepted

Huge effort. Little technical return.

Introducing a new scheme (schemes are e.g. http://, https://, ftp://, etc.) and deploying it would mean breaking backwards compatibility. Not worth it.

Political rather than technical
Ivan Ristic devotes some sentences in the introduction to his book to this.

The book is called Bulletproof SSL and TLS. You've got both the "SSL" and "TLS" right in the title. (Go figure.)

The introductory chapter is free online. The naming controversy is mentioned in section "SSL versus TLS" (page xix) and section "Protocol History" (page 3).

It seems the whole reason for renaming from SSL to TLS was political rather than technical. Ristic's footnotes link to the blog of Tim Dierks. Dierks wrote the SSL 3.0 reference implementation in 1996 and this is his take on the naming:

  • Tim Dierks, 2014-05-23, Security Standards and Name Changes in the Browser Wars (archived here):

    As a part of the horsetrading, we had to make some changes to SSL 3.0 (so it wouldn't look [like] the IETF was just rubberstamping Netscape's protocol), and we had to rename the protocol (for the same reason). And thus was born TLS 1.0 (which was really SSL 3.1). And of course, now, in retrospect, the whole thing looks silly.

Further reading

  • Here's another take on the naming. It's by Mike McCana (who operates a CA himself):
    Mike McCana, CertSimple.com blog, 2016-01-05, Why do we still say SSL? (Archived here.)
  • 1
    Thanks for your excellent answer. Gets right to the heart of the issue. – Ian Newson Jun 24 '15 at 15:38
  • If anyone cared enough, I guess a cheap way to fix this would be to call TLS 1.3 SSL 4, or similar. I'm guessing the political landscape of the 90s is no longer an issue. – Ian Newson Jun 24 '15 at 15:40
  • 3
    I'd simply add that it doesn't really matter if we call it SSL, TLS, RTS, FPS, SSS, STP, STS, or any other three letter acronym (some I think are rather clever and less dry than official names, too bad I'll forget them in 30 minutes). All non-techies care about is the S-- security. They want A (themselves) to speak with B (someone else) without C (a Bad person) getting in the middle. – phyrfox Jun 24 '15 at 17:27
  • 6
    @phyrfox Maybe call it the AB!C protocol then. – lkraider Jun 25 '15 at 4:14

Why don't we say HTTPT (HTTP over TLS) and use the scheme httpt://?

Because it would be a waste of time and money to change everything without effectively gaining anything?

  • 4
    I don't think it's right to say nothing is gained, as inconsistency costs time. It would be fair to say that not enough is gained though, or in other words the cost/benefit ratio doesn't justify it. I realise I'm splitting hairs! – Ian Newson Jun 24 '15 at 13:18
  • 1
    How this question can answer the question? Can you prove that adding a protocol would be a waste of time and money? (I'm splitting hairs too) – A.L Jun 24 '15 at 14:04
  • @A.L: I considered it obvious that it would take considerable resources to rename something which is hard-wired into millions of devices and software and is written into documentation, books etc. And the net effect is just the renaming. – Steffen Ullrich Jun 24 '15 at 14:21
  • 4
    @IanNewson: TLS is just another word for SSL, in fact TLS 1.0 is protocol SSL 3.1 etc. It would be much cheaper to teach this fact than to rename everything. – Steffen Ullrich Jun 24 '15 at 14:23
  • 1
    I think people are ignoring the actual answer. the 's' means secure so the encryption you use to do so doesn't matter. TLS, SSL etc are all separate encryption methods to create a secure protocol. Why would you ever change your URL scheme to reflect your encryption key name? The fact that one exists is why the 's' is there in the first place. – BenRacicot Jun 25 '15 at 14:19

Mostly tradition. People have been using "SSL" to refer to encrypted communications for so long that even though the protocols called SSL have all been replaced, the name has stuck around.

As for why we don't call it HTTPT, a big part of the reason is that Cool URLs Don't Change. A huge number of links in existing Web pages would break, and many of them would likely never be updated. As depressing as it can sound, we cannot count on users to understand how to convert these into HTTPT links, even though it might mean changing only one character.

Besides, Berkeley Breathed and the authors of ack might get mad.

Not the answer you're looking for? Browse other questions tagged or ask your own question.