Why SSL was renamed to TLS in late 90s (2014)

> Each of these protocols has been designed so that you could automatically negotiate versions, thus allowing for clients and servers to independently upgrade without loss of connectivity.

And ensuring decades of various downgrade attacks

> M$ (appropriate name for that time)

It’s even more appropriate nowadays, I’d say.

Nobody ever says "TLS Certificate". It's only an "SSL Certificate". On that alone, it's just easier to stick to "SSL" for consistency and everyone knows what you mean.

1. SSL. For a long time I didn't even know TLS was the "same thing", but even now that I know it is, I still say SSL 9 times out of 10.

2. 38 - Started working in 2011, but my first forays into network programming was in something like 2004-2005.

Looked over onto my other screen and sure enough the function I'd literally minutes before added an if statement to went

        public Builder sslCertNotBefore(Instant sslCertNotBefore) {
            if (sslCertNotBefore.isAfter(MAX_UNIX_TIMESTAMP)) {
                sslCertNotBefore = MAX_UNIX_TIMESTAMP;
            }
            this.sslCertNotBefore = sslCertNotBefore;
            return this;
        }

Sure on the one hand it's easier to not mess up if it's all automatic and out of sight, but at the same time, it's not exactly beneficial to the spread of deeper awareness of how TLS actually works when it's always such a black box.

I think most people call it SSL because they use OpenSSL library to deal with secure communication have SSL in their names. Openssl being the most dominant one). Other libraries are BoringSSL, LibreSSL, wolfSSL etc.

Libraries with TLS in their names are less frequently used

GnuTLS, mbedTLS, s2n-tls and RustTLS.

I usually say SSL, because it has a greater chance of being understood than the more correct TLS (nobody uses SSL 3.0 anymore). It's also in the name of many SSL (I mean, TLS) libraries, like the classic OpenSSL.

But yeah, I learned about SSL back in the crypto wars days of the 1990s, back when you had to pirate the so-called "US only" version of Netscape if you wanted decent SSL encryption, so I might be just using the old term out of habit.

I say "https" because sometimes even regular people know what that means.

SSL - In my 40s, over 20 plus years.

When do I say TLS, when that one annoying guy joins the call that always corrects you. Everyone hates him, and he doesn’t care.

These days I tend to say "TLS" more and more, but until just a year or two ago it was almost always "SSL". And "SSL" still slips out occasionally.

I'm 51, started working in IT in the mid 90's.

To users: https

To devs: SSL

Did not start working before 1999. Started using Linux in 2003.

Same. I feel so dumb now. After 15 years in this industry i finally figured out that ssl and tls are the same.

The problem is that TLS was already in widespread use for "thread local storage".

Transport Layer Security is widely documented as beginning in 1999.

I can find references to "Thread Local Storage" going back to at least 1996. That particular term seems more common in the Microsoft (and maybe IBM, does anyone have an OS/2 programming manual?) world at the time; Pthreads (1995) and Unix in general tended to call it "thread-specific data".

It's possible that the highly influential 2001 Itanium ABI document (which directly led to Drepper's TLS paper) brought the term to (widespread) use in the broader Unix world, though Sun (for both Solaris and Java?) was using the term previously. But it's also possible that I'm just missing the reference material.

I think SSL is a better fit, actually. In theory TLS could be a transport-layer security mechanism that would let arbitrary protocols run on top of it (like IPSec does), but in practice it's pretty much tied up to TCP sockets. The UDP variant (DTLS, and I suppose QUIC) isn't part of the TLS spec for instance. Of course we have kernel TLS on Linux now, and Windows also has infrastructure like that, but it isn't as easy as setting a flag on a socket to turn TLS on.

Plus, who doesn't like to sound like a snake sometimes? Snakes are badass.

“SSL” is easier to pronounce, because the tongue barely changes position between the three letters, compared to “TLS”.

picture kaa from the jungle book discussing tcp security and arguing for the s-s-l name. In fact maybe adding a 3rd s.

> This was written in 1996. The language used feels already much different from today's publications. God I feel old.

That depends on which publications you're looking at, just as it did in 1996. An article from LWN [1] today, for example, reads in a fairly similar style. Maybe slightly less stuffy, because it's targeted at a slightly more general audience.

[1] https://lwn.net/

The main difference is in the padding. When the POODLE attack was pre-announced as only affecting SSL3 and not TLS1.0, that was enough to predict it was going to be a padding oracle.

I think it’s fair to say they’re very similar, with a few “bug fixes”. It’s been a while since I’ve thought about either though, and might be forgetting a few things. I’ve only ever implemented SSL3 and TLS1.0 together, so there may be some details I’m forgetting.

Indeed there are significant changes and improvements, though it’s not a complete redesign like SSL 3.0 was.

There's really not much chance of that, given that the protocol is maintained by the IETF TLS Working Group.

“TLS” is also used in a bunch of places already, too. Updating config file formats and function signatures will be a PITA.

Please don't give anybody any ideas!

But how many clients are still using it? As far as my understanding goes, no relevant, up to date piece of software/library still supports