Bridge SSL
SSL and TLS glossary: short definitions
This glossary gives each term of SSL and TLS vocabulary a definition you can read in half a minute. A definition says what the thing is. The page it points to says how it works, how it breaks and how to check it. The handshake, the cipher suite and the TLS version have no page of their own, so they are defined here and only here.
Protocol and handshake
- SSL and TLS
- SSL is the older name of the protocol and TLS is its successor: TLS 1.0 was written as a revision of SSL 3.0. People still say SSL certificate for what is now a TLS certificate, so the two names mix freely. The difference in detail is SSL vs TLS.
- TLS version
- The numbered release of the protocol that a connection runs. Client and server settle on one release during the handshake.
- TLS handshake
- The negotiation before any application data moves. The two sides agree on a protocol version and a cipher suite, the server proves its identity with a certificate, and both derive the keys that protect the rest of the connection.
- Cipher suite
- The named combination of algorithms that two sides agree to use for a connection. It fixes how the data is encrypted and authenticated.
- SNI
- Server Name Indication is the field in the first handshake message where a client names the site it wants, so one address can present the right certificate among many.
Web connections
- Port 443
- The default port for HTTPS. A browser connects to it when an address starts with https and names no other port.
- HTTPS
- HTTP carried inside a TLS connection, so the browser knows which server it reached and the traffic is encrypted on the way. See how HTTPS differs from HTTP.
- HSTS
- A declaration, sent by a site in a response header, that browsers should reach it only over HTTPS and remember that for the period the site states.
- mTLS
- Mutual TLS. During the TLS handshake the server asks the client for a certificate too, so each side proves who it is rather than only the server.
Certificates and keys
- Digital certificate
- Signed data that ties a public key to a name. A website certificate is one kind. Email and code-signing certificates are others, and they differ in purpose.
- X.509
- The standard format of SSL and TLS certificates. It defines the fields that a certificate carries, such as subject, issuer, validity and public key. Reading them one by one is the job of the x509 page.
- CN certificates
- The common name (CN) is a name attribute in the certificate subject. Current rules for hostname checks tell clients to ignore it, which is the whole question behind a CN certificate.
- PEM file
- A certificate or key saved as base64 text between BEGIN and END lines.
- Public key
- Public key cryptography uses a key pair: a private key that stays with its owner and a public key that anyone may hold. What is public key cryptography, and which key does what in a certificate, is answered at what is public key cryptography.
- Certificate store
- The place where an operating system keeps certificates, sorted by purpose. The Windows version has its own page: windows ssl certificate store.
Trust and checking
- Certificate transparency
- The public logging of issued certificates, which is what makes an unexpected issuance discoverable rather than silent.
- OCSP stapling
- The server presenting recent proof that its certificate has not been revoked, instead of leaving the client to go and ask.
- Certificate pinning
- A rule on the client that accepts only a known key or certificate for a server, whatever else a trusted authority has signed.
- SSL vs SSH
- Two different protocols that both secure a connection. SSH is a protocol for secure remote login, while SSL and TLS secure application traffic, websites included, with certificates that an authority signs. The longer comparison is ssl vs ssh: what is the difference?
Which page answers which problem
Start from what you are looking at, not from the term. The table sends each situation to the one page that covers it.
| You are looking at | Start with |
|---|---|
| One server address hosts many HTTPS sites and shows the wrong certificate | SNI |
| A browser refuses the plain HTTP version of a site | HSTS |
| An app rejects a certificate that was just renewed | certificate pinning |
| A server has to check who the client is | mTLS |
| A certificate was issued for your domain and you did not ask for it | certificate transparency |
| A firewall rule needs the HTTPS port | port 443 |
| You are choosing between SFTP and FTPS | ssl vs ssh |
| A file starts with a BEGIN line and you do not know what it holds | pem file |
How to read the rest of the site
An entry in this SSL glossary answers what a term means in SSL and TLS. The TLS handshake, cipher suites and SNI in action sit in the TLS section, what an X.509 certificate is and how to get one sits under certificates along with the public key and the certificate store, and what a browser message means sits under errors, which is sorted by the text you saw. Issuance that runs without a person is explained under the acme protocol, and about bridge ssl says who writes these pages and how they are checked.
A term with a page of its own is better served by that page than by a paragraph here, which is why this list is shorter than the vocabulary of the subject.