TLS’s predecessor, secure socket layer (SSL) was developed by Netscape in 1995. SSL version 1.0 and 2.0 contained many security flaws that prompted a complete redesign of the protocol.
SSL/Early TLS Users: June 30 2018 is the dealine to migrate to TLS 1.1 or higher. 30 June 2018 is the deadline for disabling SSL/early TLS and implementing a more secure encryption protocol – TLS 1.1 or higher (TLS v1.2 is strongly encouraged) in order to meet the PCI Data Security Standard (PCI DSS) for safeguarding payment data. Secure Sockets Layer (SSL) är en säkerhetsmekanism som uppfanns till Netscape och användes för att kryptera kommunikationen mellan två enheter. Numera har SSL ersatts av Transport Layer Security för att åtgärda de säkerhetsbrister som finns i SSL. "This script repeatedly initiates SSL/TLS connections, each time trying a new cipher or compressor while recording whether a host accepts or rejects it. The end result is a list of all the ciphers and compressors that a server accepts." SSL 1.0 was never publicly released, whilst SSL 2.0 was quickly replaced by SSL 3.0 on which TLS is based. TLS was first specified in RFC 2246 in 1999 as an applications independent protocol, and whilst was not directly interoperable with SSL 3.0, offered a fallback mode if necessary. The wolfSSL lightweight SSL library implements the following protocols: SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3; DTLS 1.0, DTLS 1.2, DTLS 1.3; Protocol Notes: SSL 2.0 - SSL 2.0 was deprecated (prohibited) in 2011 by RFC 6176. wolfSSL does not support it. SSL 3.0 - SSL 3.0 was deprecated (prohibited) in 2015 by RFC 7568. The Browser Exploit Against SSL/TLS attack was published in September 2011 and affects SSL 3.0 and TLS 1.0. An attacker can “decrypt” data exchanged between two parties by taking advantage of a vulnerability in the implementation of the Cipher Block Chaining (CBC) mode in TLS 1.0 which allows them to perform chosen plaintext attack. Secure Sockets Layer (SSL) was developed in the mid 1990’s by Netscape which was known to among the most popular browsers during the early days. Although SSL 1.0 was never released in the public, SSL 2.0 was known to have some flaws, but SSL 3.0 was released in 1996 which was updated and used few years ago but become obsolete after the entry of TLS version.
この脆弱性はssl 3.0の仕様のみに存在するものでありtls 1.0以降に影響はないが、主要なすべてのブラウザではtlsでのハンドシェイクが失敗した場合にssl 3.0での接続にダウングレードする。
OpenSSLWiki This is the OpenSSL wiki. The main site is https://www.openssl.org.If this is your first visit or to get an account please see the Welcome page. Your participation and Contributions are valued.. This wiki is intended as a place for collecting, organizing, and refining useful information about OpenSSL that is currently strewn among multiple locations and formats. Transport Layer Security - Web security | MDN
SSL, съкращение от Secure Sockets Layer, е криптографски протокол за връзка клиент-сървър, разработен от Netscape Communications Corporation за пренасяне на информация през интернет.
Transport Layer Security（トランスポート・レイヤー・セキュリティ、TLS）は、インターネットなどのコンピュータネットワークにおいてセキュリティを要求される通信を行うためのプロトコルである。 主な機能として、通信相手の認証、通信内容の暗号化、改竄の検出を提供する。