[HN Gopher] Why SSL was renamed to TLS in late 90s (2014)
___________________________________________________________________
Why SSL was renamed to TLS in late 90s (2014)
Author : Bogdanp
Score : 109 points
Date : 2025-06-15 14:10 UTC (8 hours ago)
(HTM) web link (tim.dierks.org)
(TXT) w3m dump (tim.dierks.org)
| WhyNotHugo wrote:
| I like this writing style. Informative, has some
| flavour/personality, but clear and concise.
| userbinator wrote:
| tl;dr: politics.
|
| I still like to occasionally refer to TLS 1.3 as "SSL 3.4" to see
| whether people are aware of the history.
| pkulak wrote:
| "Transport Layer Security" really is a better name though. I also
| like to say "TLS". Two Ses in a row makes you sound like a snake.
| jeroenhd wrote:
| I think SSL is a better fit, actually. In theory TLS could be a
| transport-layer security mechanism that would let arbitrary
| protocols run on top of it (like IPSec does), but in practice
| it's pretty much tied up to TCP sockets. The UDP variant (DTLS,
| and I suppose QUIC) isn't part of the TLS spec for instance. Of
| course we have kernel TLS on Linux now, and Windows also has
| infrastructure like that, but it isn't as easy as setting a
| flag on a socket to turn TLS on.
|
| Plus, who doesn't like to sound like a snake sometimes? Snakes
| are badass.
| LukeShu wrote:
| No? The "transport" layer is layer 4 in the 7-layer OSI model
| (physical/datalink/network/transport/session/presentation/app
| lication) and 5-layer IP model
| (physical/network/internetwork/transport/application). That
| is: the "transport" provides reliable continuous data-stream
| abstraction over the lower-layers' discreet and unreliable
| packets; e.g. TCP.
|
| And that data-stream the interface that TLS provides; to the
| higher layers it looks like a transport layer.
| o11c wrote:
| The problem is that TLS was already in widespread use for
| "thread local storage".
|
| Transport Layer Security is widely documented as beginning in
| 1999.
|
| I can find references to "Thread Local Storage" going back to
| at least 1996. That particular term seems more common in the
| Microsoft (and maybe IBM, does anyone have an OS/2 programming
| manual?) world at the time; Pthreads (1995) and Unix in general
| tended to call it "thread-specific data".
|
| It's possible that the highly influential 2001 Itanium ABI
| document (which directly led to Drepper's TLS paper) brought
| the term to (widespread) use in the broader Unix world, though
| Sun (for both Solaris and Java?) was using the term previously.
| But it's also possible that I'm just missing the reference
| material.
| kstrauser wrote:
| I don't doubt that, but I never heard Thread Local Storage
| until much later than that. While it might well've been
| common within its ecosystem, I don't think it was widely
| known outside it.
| JdeBP wrote:
| I might have an OS/2 programming manual. But I don't need it.
| (-: This was not an OS/2 thing. We had to make map data
| structures using thread IDs. Or our language runtimes did.
|
| Look to Windows NT rather than to OS/2 for thread-local
| storage. TlsAlloc() et al. were in the Win32 API right from
| NT 3.1, I think.
| andrewfromx wrote:
| picture kaa from the jungle book discussing tcp security and
| arguing for the s-s-l name. In fact maybe adding a 3rd s.
| layer8 wrote:
| "SSL" is easier to pronounce, because the tongue barely changes
| position between the three letters, compared to "TLS".
| chollida1 wrote:
| > As a part of the cutthroat competition, Microsoft decided to
| revise the SSL 2 protocol with some additions of their own, and
| specified a protocol called "PCT" that was derived from SSL 2. It
| was only supported in IE and IIS.
|
| > Netscape also wanted to address SSL 2 issues, but wasn't going
| to let Microsoft take leadership/ownership in the standard, so
| they developed SSL 3.0, which was a more significant departure.
|
| I remember this moment and this is where I realized that
| Microsoft wasn't always the bad guy here. They had the better
| implementation and were willing to share it. But Netscape in this
| instance acted like kids and wouldn't cooperate at all. Which is
| why this meeting had to occur and by that point it was clear
| Netscape had lost the browser and it wasn't going to be close.
|
| Hence the quick about face by Netscape to accept what was pretty
| much Microsoft's proposed solution.
|
| I can't speak to the rest of Microsoft's browser decisions and
| given the court ruling it's clear they weren't the good guys
| either but this opened my eyes to the fact that all companies are
| the bad guys some time:)
| TZubiri wrote:
| Microsoft was the bad guy in a movie where you have a war right
| before aliens invade and you figure out that there's bigger
| enemies.
|
| FSF hated Microsoft because they released binaries without
| source code, they were THE enemy, nowadays, you are lucky if
| you get a binary to study and modify! The standard from any
| competitive developer is to hide the binary and source behind a
| server. Try to study and modify that!
| chollida1 wrote:
| I agree with your entire statement:)
| simfree wrote:
| Flaky, unreliable, not web standards compliant, hosted
| services suck to deal with.
|
| Who needs to add a CORS header to allow Sentry.io or
| Cloudflare's metrics to work on this 2014 era SaaS that the
| developer has wandered away from?
| thayne wrote:
| Forcing the name to be chnaged from SSL to TLS seems pretty
| petty to me.
|
| Two decades later, and it is still common for people to call
| TLS SSL.
| hsbauauvhabzb wrote:
| Fool me once, shame on you. Fool me twice?
| amenghra wrote:
| I remember "SSL and TLS: Designing and Building Secure Systems"
| by Eric Rescorla being really useful to understand the history
| behind TLS and how we got here. The book was written in 2001 and
| warned about some issues which turned into CVEs a bit later. You
| might find used copies for a couple bucks.
| ricardo81 wrote:
| This is one of those ones where it's awkward with a certain
| crowd. At some point SSL was https and class C meant a /24
| subnetwork for webmaster types.
|
| I've found that certain crowds will get angry about the
| vernacular vs a crowd that always understood something a
| particular way.
|
| In any event, we have to stick with the times, especially with
| new entrants that stick with the new terms.
| ahofmann wrote:
| Oh wow, I just discovered that my brain unconsciously had a hard
| time to differentiate between SSL and TLS. And now, after two
| friggin decades I find out, why!
| oc1 wrote:
| Same. I feel so dumb now. After 15 years in this industry i
| finally figured out that ssl and tls are the same.
| 0xbadcafebee wrote:
| No no, they're not. They're names of specific protocols with
| specific capabilities and versions. "SSL 1.0" and "TLS 1.0"
| are _very_ different. (see
| https://aws.amazon.com/compare/the-difference-between-ssl-
| an...)
|
| The important bits:
|
| - "SSL" is a set of protocols so ridiculously old, busted and
| insecure that nobody should ever use them. It's like talking
| about Sanskrit; ancient and dead.
|
| - "TLS" is way better than "SSL", but still there are
| insecure versions. Any version before 1.2 is no longer
| supported due to security holes.
|
| - Technically an "ssl certificate" is neither "SSL" nor
| "TLS", it's really an "X.509 Certificate with Extended Key
| Usage: Server Authentication". But that doesn't roll off the
| tongue. You could use a cert from 1996 in a modern TLS
| server; the problem would be its expiration date, and the
| hash/signature functions used back then are deprecated. (some
| servers still support insecure methods to support older
| clients, which is bad)
| MOARDONGZPLZ wrote:
| Right, but they accomplish the same thing and people move
| monotonically from SSL to TLS. It's not like choosing
| between React and Angular, but like choosing between React
| version 5 and React version 10 for a new project. SSL and
| TLS are the same in all meaningful respects from this
| perspective.
| 0xbadcafebee wrote:
| Hotdogs and hamburgers are the same in all meaningful
| respects.
| MOARDONGZPLZ wrote:
| They are not. But a Chicago dog is meaningfully the same
| as a New York Dog (just with some more vegetables).
| JdeBP wrote:
| Back closer to the time, there were some people around who
| insisted that SSL specifically meant the old versions and it
| was all TLS now. I recall a couple of occasions where people
| were talking about UCSPI-SSL and someone stepped in to
| explain that We Don't Do SSL Now. As the headlined article
| says, that contrived distinction seems silly with the
| hindsight of decades.
|
| The nomenclature was complicated in people's minds by SMTP.
| Because there was SMTP over a largely transparent encrypted
| connection, and SMTP where it started unencrypted and
| negotiated a switch, as well as plain old cleartext. It
| didn't help that RFC 2487 explained that STARTTLS negotiated
| "TLS more commonly known as SSL". RFC 8314 explains some of
| the historical mess that SMTP got into with two types of SMTP
| (relay and submission) and three types of transport.
|
| And the "S" for "submission" could be confused with the "S"s
| in _both_ "SSL" and "TLS". It's not just TLAs that are
| ambiguous, indeed. There was confusion over "SMTPS" and
| "SSMTP", not helped at all by the people who named programs
| things like "sSMTP".
|
| I'm still calling it SSL in 2025. (-: And so is Erwin
| Hoffmann.
|
| * https://www.fehcom.de/ipnet/sslserver.html
|
| * https://manpages.debian.org/unstable/ssmtp/ssmtp.8.en.html
| yardstick wrote:
| Would adoption of the new name been easier if the version started
| at TLS 3.0/matched the SSL version it originated from?
| layer8 wrote:
| One reason it didn't is that existing standard libraries had
| "SSL" ingrained in their API identifiers.
| tptacek wrote:
| NB: I feel like the consensus was very firmly established by 2014
| that SSL 2.0 was gravely flawed (its handshake isn't even
| properly authenticated).
| albert_e wrote:
| Related
|
| Randomness and the Netscape Browser January 1996 Dr. Dobb's
| Journal
|
| https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.ht...
|
| This was written in 1996. The language used feels already much
| different from today's publications. God I feel old.
| quietbritishjim wrote:
| > This was written in 1996. The language used feels already
| much different from today's publications. God I feel old.
|
| That depends on which publications you're looking at, just as
| it did in 1996. An article from LWN [1] today, for example,
| reads in a fairly similar style. Maybe slightly less stuffy,
| because it's targeted at a slightly more general audience.
|
| [1] https://lwn.net/
| disruptiveink wrote:
| Wait, but didn't TLS 1.0 have significant improvements over SSL
| 3.0? The article makes it seems that just a couple of things were
| tweaked just to make it different for the sake of being
| different.
| layer8 wrote:
| Indeed there are significant changes and improvements, though
| it's not a complete redesign like SSL 3.0 was.
| jedberg wrote:
| Curious, when you tell someone they need to access a website
| securely (or any other case where you might use the term TLS or
| SSL), do you:
|
| 1. Say SSL or TLS?
|
| 2. How old are you (or did you start working before 1999?)
|
| I'll reply with my answer too.
| jedberg wrote:
| 1. SSL
|
| 2. Started working before 1999
| curmudgeon22 wrote:
| SSL, started computer science in 2010
| jedberg wrote:
| I was going to reply to you and tell you that you're too
| young to be a curmudgeon, but then I realized, no, I'm just
| old!
| gryfft wrote:
| Reflex is to say SSL but usually correct myself to TLS. Started
| in IT in 2006 (was a nerd a few years before that though)
| jozvolskyef wrote:
| I second this, started around the same time.
| Rendello wrote:
| SSL, started programming in maybe 2012. Possibly because of
| HTTPS or similarity with SSH.
| amiga386 wrote:
| I say HTTPS certificate.
|
| If I need to specifically say SSL or TLS, it's SSL (as in
| OpenSSL, LibreSSL, BoringSSL, SSL certificates, Qualys SSL
| Labs, SSL Server Test). TLS is a made up name for SSL.
|
| I do say e.g. "TLSv1.2" if I need to name the specific
| protocol, that's about it.
|
| I was working before 1999.
| firesteelrain wrote:
| I tell my developers to be compliant that they need to use
| TLS/SSL
| Octoth0rpe wrote:
| 1. SSL 2. Started working in 2000, right on the boundary
| tptacek wrote:
| I say TLS, and started working in the field in 1994.
| mindcrime wrote:
| These days I tend to say "TLS" more and more, but until just a
| year or two ago it was almost always "SSL". And "SSL" still
| slips out occasionally.
|
| I'm 51, started working in IT in the mid 90's.
| ThunderSizzle wrote:
| 1. SSL (probably https in that specific scenario)
|
| 2. Graduated and started in 2015.
| brandonmenc wrote:
| I say "https" because sometimes even regular people know what
| that means.
| marginalia_nu wrote:
| 1. SSL. For a long time I didn't even know TLS was the "same
| thing", but even now that I know it is, I still say SSL 9 times
| out of 10.
|
| 2. 38 - Started working in 2011, but my first forays into
| network programming was in something like 2004-2005.
|
| Looked over onto my other screen and sure enough the function
| I'd literally minutes before added an if statement to went
| public Builder sslCertNotBefore(Instant sslCertNotBefore) {
| if (sslCertNotBefore.isAfter(MAX_UNIX_TIMESTAMP)) {
| sslCertNotBefore = MAX_UNIX_TIMESTAMP; }
| this.sslCertNotBefore = sslCertNotBefore;
| return this; }
| aniviacat wrote:
| 1. TLS
|
| 2. Started working after 1999
| cesarb wrote:
| I usually say SSL, because it has a greater chance of being
| understood than the more correct TLS (nobody uses SSL 3.0
| anymore). It's also in the name of many SSL (I mean, TLS)
| libraries, like the classic OpenSSL.
|
| But yeah, I learned about SSL back in the crypto wars days of
| the 1990s, back when you had to pirate the so-called "US only"
| version of Netscape if you wanted decent SSL encryption, so I
| might be just using the old term out of habit.
| christophilus wrote:
| SSL. Started working around 2000.
| aag wrote:
| I seem to remember that Microsoft's initial implementation used a
| field in the protocol in an incompatible way to encode that it
| was a different implementation. I remember people being annoyed
| at them for deliberately screwing up future compatibility. Does
| anyone remember the details of this?
___________________________________________________________________
(page generated 2025-06-15 23:00 UTC)