4 ms·

Dumb question, but has the industry decided on what they want to call TLS/HTTPS? Majority of people I talk to still refer to them as SSL certs...

by lenova 8y ago

atombender 8y ago
Old habits die hard. The current standard is TLS, which superceded SSL back in 1999. Uptake and awareness was initially slow, and SSL itself wasn't deprecated until 2015. It doesn't help that a bunch of projects (OpenSSL being a prominent one) still have "SSL" in their name. Technically, they're not "SSL certs". They're X.509 certs. Certificates show up in many places unrelated to TLS/SSL.
- tialaramex 8y ago
  Well, the things people want aren't (generally) just X.509 certificates. If you expect your certificates to work in common client software like web browsers or some random Python client code a third party is writing then you're going to want: * PKIX, currently RFC 5280 plus revisions, the Internet's chosen standard for how X.509 should be implemented. PKIX says a bunch of things about what you should or should not write in the X.509 certificate, you will probably have better luck conforming as much as possible even if you don't care about: * The Web PKI. A Public Key Infrastructure has Certificate Authorities (plenty of those across all of X.509 or you can roll your own) but they're trusted by Relying Parties (parties who are _relying_ on the certificate's attestation to be true) and you probably want certificates that will be trusted by most RPs. Grandma doesn't know what the X.500 directory system is, or who a Certificate Authority is, but she does use Safari, and Safari trusts certain CAs on her behalf as does macOS. So you're going to want certs from one of those CAs. The Web PKI is a loose name for (despite that word "Web") the PKI covering SSL/TLS services on the Internet. * You may want to get more specific. Although the Baseline Requirements which say roughly how a Certificate Authority should work are agreed across industry, each of the Major Trust Stores has their own additional rules. You probably care about all of them. They roughly correspond to operating system vendors. Microsoft and Apple (for their browsers and operating systems), then Mozilla (for Firefox on all platforms, and for Free Unix systems), Google (mostly just for Android, not Chrome), and then runners up Oracle (for Java), then a long tail of people including Nintendo and all those crappy in-car entertainment systems people... For example, probably fifty people in the whole world have ever bothered trying to use the Web from a Nintendo WiiU (not to be confused with the popular Wii) console. If they try now though lots of things don't work. Because Let's Encrypt isn't trusted by the WiiU, and since it's an end-of-life product, probably never will be. But "SSL Certs" gets across what you mean pretty well, only pedants are going to insist it's wrong, and unless you're currently playing "Um, Actually" they should cut it out.
Edmond 8y ago
it is TLS...SSL is just much better known and likely would be around until written references to SSL go away..it would be a while :) SSL references "sockets", which is still where TLS is implemented but TLS is conceptually about transport security independent of implementation (ala sockets)....for instance consider this TLS inspired solution (https://www.cipheredtrust.com/doc/ https://www.cipheredtrust.com/doc/), it has nothing to do with sockets.
naniwaduni 8y ago
For the most part, it's called SSL. Hell, it's even more taxonomically coherent, take it from the bear: > So basically, the “SSL vs TLS” taxonomy represents the ownership change in 1999, but not the technical details of the protocols. From a purely technical point of view, lumping together SSL-3.0 with SSL-2.0 but separating it from the TLS versions is about as wrong as, in biology, classifying whales as a kind of fish (despite what Herman Melville wrote about them). > Therefore, I tend to use “SSL” (or “SSL/TLS”) to designate the whole conceptual family of protocols, from SSL-1.0 to TLS-1.2. This is the main reason why BearSSL is called BearSSL and not BearTLS. > A secondary reason is more about marketing. People who know what TLS is also know what SSL is, but not the other way round. For instance, Web site owners look for a “SSL certificate”, not a “TLS certificate”. By using the “SSL” acronym, I thus reach a wider audience, even if it is at the cost of irritating some of the more pickish taxonomists (and I am totally ready to out-pedant them if need be, as demonstrated above). (https://bearssl.org/naming.html https://bearssl.org/naming.html)
- kevin_thibedeau 8y ago
  PolarSSL took the plunge and renamed. It isn't impossible.
  - naniwaduni 8y ago
    TLS is our octopi.
isodude 8y ago
My customers won't stop calling them SLL Certificates. Drives me mad.
aphextron 8y ago
> Dumb question, but has the industry decided on what they want to call TLS/HTTPS? Majority of people I talk to still refer to them as SSL certs... They are all independent terms. Secure Socket Layers (SSL) is an outdated term that refers to any network data transfer over Transmission Control Protocol (TCP) using the Transport Layer Security (TLS) protocol, of which the Hypertext Transfer Protocol Secure (HTTPS) protocol is an application layer implementation.

Dumb question, but has the industry decided on what they want to call TLS/HTTPS? Majority of people I talk to still refer to them as SSL certs...

by lenova 8y ago

Dumb question, but has the industry decided on what they want to call TLS/HTTPS? Majority of people I talk to still refer to them as SSL certs...

atombender 8y ago

Old habits die hard. The current standard is TLS, which superceded SSL back in 1999. Uptake and awareness was initially slow, and SSL itself wasn't deprecated until 2015. It doesn't help that a bunch of projects (OpenSSL being a prominent one) still have "SSL" in their name. Technically, they're not "SSL certs". They're X.509 certs. Certificates show up in many places unrelated to TLS/SSL.

tialaramex 8y ago
Well, the things people want aren't (generally) just X.509 certificates. If you expect your certificates to work in common client software like web browsers or some random Python client code a third party is writing then you're going to want: * PKIX, currently RFC 5280 plus revisions, the Internet's chosen standard for how X.509 should be implemented. PKIX says a bunch of things about what you should or should not write in the X.509 certificate, you will probably have better luck conforming as much as possible even if you don't care about: * The Web PKI. A Public Key Infrastructure has Certificate Authorities (plenty of those across all of X.509 or you can roll your own) but they're trusted by Relying Parties (parties who are _relying_ on the certificate's attestation to be true) and you probably want certificates that will be trusted by most RPs. Grandma doesn't know what the X.500 directory system is, or who a Certificate Authority is, but she does use Safari, and Safari trusts certain CAs on her behalf as does macOS. So you're going to want certs from one of those CAs. The Web PKI is a loose name for (despite that word "Web") the PKI covering SSL/TLS services on the Internet. * You may want to get more specific. Although the Baseline Requirements which say roughly how a Certificate Authority should work are agreed across industry, each of the Major Trust Stores has their own additional rules. You probably care about all of them. They roughly correspond to operating system vendors. Microsoft and Apple (for their browsers and operating systems), then Mozilla (for Firefox on all platforms, and for Free Unix systems), Google (mostly just for Android, not Chrome), and then runners up Oracle (for Java), then a long tail of people including Nintendo and all those crappy in-car entertainment systems people... For example, probably fifty people in the whole world have ever bothered trying to use the Web from a Nintendo WiiU (not to be confused with the popular Wii) console. If they try now though lots of things don't work. Because Let's Encrypt isn't trusted by the WiiU, and since it's an end-of-life product, probably never will be. But "SSL Certs" gets across what you mean pretty well, only pedants are going to insist it's wrong, and unless you're currently playing "Um, Actually" they should cut it out.

Edmond 8y ago

it is TLS...SSL is just much better known and likely would be around until written references to SSL go away..it would be a while :) SSL references "sockets", which is still where TLS is implemented but TLS is conceptually about transport security independent of implementation (ala sockets)....for instance consider this TLS inspired solution (https://www.cipheredtrust.com/doc/ https://www.cipheredtrust.com/doc/), it has nothing to do with sockets.

naniwaduni 8y ago

For the most part, it's called SSL. Hell, it's even more taxonomically coherent, take it from the bear: > So basically, the “SSL vs TLS” taxonomy represents the ownership change in 1999, but not the technical details of the protocols. From a purely technical point of view, lumping together SSL-3.0 with SSL-2.0 but separating it from the TLS versions is about as wrong as, in biology, classifying whales as a kind of fish (despite what Herman Melville wrote about them). > Therefore, I tend to use “SSL” (or “SSL/TLS”) to designate the whole conceptual family of protocols, from SSL-1.0 to TLS-1.2. This is the main reason why BearSSL is called BearSSL and not BearTLS. > A secondary reason is more about marketing. People who know what TLS is also know what SSL is, but not the other way round. For instance, Web site owners look for a “SSL certificate”, not a “TLS certificate”. By using the “SSL” acronym, I thus reach a wider audience, even if it is at the cost of irritating some of the more pickish taxonomists (and I am totally ready to out-pedant them if need be, as demonstrated above). (https://bearssl.org/naming.html https://bearssl.org/naming.html)

kevin_thibedeau 8y ago
PolarSSL took the plunge and renamed. It isn't impossible.
- naniwaduni 8y ago
  TLS is our octopi.

isodude 8y ago

My customers won't stop calling them SLL Certificates. Drives me mad.

aphextron 8y ago

> Dumb question, but has the industry decided on what they want to call TLS/HTTPS? Majority of people I talk to still refer to them as SSL certs... They are all independent terms. Secure Socket Layers (SSL) is an outdated term that refers to any network data transfer over Transmission Control Protocol (TCP) using the Transport Layer Security (TLS) protocol, of which the Hypertext Transfer Protocol Secure (HTTPS) protocol is an application layer implementation.