https://www.fastmail.com/help/technical/ssltlsstarttls.html

SSL vs TLS vs STARTTLS

There's often quite a bit of confusion around the different terms SSL, TLS and STARTTLS.

SSL and TLS both provide a way to encrypt a communication channel between two computers (e.g. your computer and our server). TLS is the successor to SSL and the terms SSL and TLS are used interchangeably unless you're referring to a specific version of the protocol.

STARTTLS is a way to take an existing insecure connection and upgrade it to a secure connection using SSL/TLS. Note that despite having TLS in the name, STARTTLS doesn't mean you have to use TLS, you can use SSL.

SSL/TLS version numbers

Version numbering is inconsistent between SSL and TLS versions. When TLS took over from SSL as the preferred protocol name, it began a new version number, and also began using sub-versions. So the ordering of protocols in terms of oldest to newest is: SSL v2, SSL v3, TLS v1.0, TLS v1.1, TLS v1.2, TLS v1.3 (currently proposed).

When you connect to an SSL/TLS encrypted port, or use STARTTLS to upgrade an existing connection, both sides will negotiate which protocol and which version to use based on what has been configured in the software and what each side supports.

Support for SSL/TLS is virtually universal these days, however which versions are supported is variable. SSL v2 was deprecated and phased out many years ago due to security issues. SSL v3 is currently deprecated due to security issues, and support has or is being phased out by most services these days. Almost all software supports TLS v1.0. As at October 2016, support for TLS v1.1 and TLS v1.2 is also very good, though there are some exceptions, mostly with Internet Explorer.

TLS vs STARTTLS naming problem

One significant complicating factor is that some email software incorrectly uses the term TLS when they should have used STARTTLS. Older versions of Thunderbird in particular used "TLS" to mean "enforce use of STARTTLS to upgrade the connection, and fail if STARTTLS is not supported" and "TLS, if available" to mean "use STARTTLS to upgrade the connection if the server advertises support for it, otherwise just use an insecure connection".

SSL/TLS vs plaintext/STARTTLS port numbers

The above is particularly problematic when combined with having to configure a port number for each protocol.

To add security to some existing protocols (e.g. IMAP, POP, etc.), it was decided to just add SSL/TLS encryption as a layer underneath the existing protocol. However, to distinguish that software should talk the SSL/TLS encrypted version of the protocol rather than the plaintext one, a different port number was used for each protocol. So you have:

  • IMAP uses port 143, but SSL/TLS encrypted IMAP uses port 993.
  • POP uses port 110, but SSL/TLS encrypted POP uses port 995.
  • SMTP uses port 25, but SSL/TLS encrypted SMTP uses port 465.

At some point, it was decided that having 2 ports for every protocol was wasteful, and instead you should have 1 port that starts off as plaintext, but the client can upgrade the connection to an SSL/TLS encrypted one. This is what STARTTLS was created to do.

There were a few problems with this though. There was already existing software that used the alternate port numbers with pure SSL/TLS connections. Client software can be very long lived, so you can't just disable the encrypted ports until all software has been upgraded.

Mechanisms were added to each protocol to tell clients that the plaintext protocol supported upgrading to SSL/TLS (i.e. STARTTLS), and that they should not attempt to log in without doing the STARTTLS upgrade. This created two unfortunate situations:

  1. Some software just ignored the "login disabled until upgraded"announcement and just tried to log in anyway, sending the username and password over plaintext. Even if the server then rejected the login, the details had already been sent over the Internet in plaintext.
  2. Other software saw the "login disabled until upgraded" announcement, but then wouldn't upgrade the connection automatically, and thus reported login errors back to the user, which caused confusion about what was wrong.

Both of these problems resulted in significant compatibility issues with existing clients, and so most system administrators continued to just use plaintext connections on one port number, and encrypted connections on a separate port number.

This has now basically become the de facto standard that everyone uses. IMAP SSL/TLS encrypted over port 993 or POP SSL/TLS encrypted over port 995. Many sites (including FastMail) now disable plain IMAP (port 143) and plain POP (port 110) altogether so people must use an SSL/TLS encrypted connection. By disabling ports 143 and 110, this removes completely STARTTLS as even an option for IMAP/POP connections.

SMTP STARTTLS as an exception

The one real exception to the above is SMTP. However that's for a different reason again. Most email software (known as a mail user agent) used SMTP on port 25 to submit messages to the email server for onward transmission to the destination (known as a mail transfer agent). However, SMTP was originally designed for transfer, not submission. So yet another port (587) was defined for message submission.

Although port 587 doesn't mandate requiring STARTTLS, the use of port 587 became popular around the same time as the realisation that SSL/TLS encryption of communications between clients and servers was an important security and privacy issue and encryption extensions were being defined for sMTP. So shortly after port 465 was defined, it was revoked with the expectation that clients would move to using STARTTLS over port 587

The result is that in most cases, systems that offer message submission over port 587require clients to use STARTLS to upgrade the connection and also require a username and password to authenticate. There has been an added benefit to this approach as well. By moving users away from using port 25 for email submission, ISPs are now able to block outgoing port 25 connections from users' computers, which were a significant source of spam due to infection with spam-sending viruses.

Unfortunately the downside of changing port numbers is that a number of email clients were made which only supported SSL/TLS over port 465 and not STARTTLS on 587. Clients are often very long lived, and so removing port 465 wasn't an option for many sites without annoying customers. Additionally, because port 465 was advertised as an option, many users with email clients that support both STARTTLS on 587 and SSL/TLS on 465 set them up to use 465 instead of 587. This makes it even harder to remove support for port 465, since lots of users have their email clients set up to use it.

Currently, things seem relatively randomly split between people using SMTP SSL/TLS encrypted over port 465, and people using SMTP with STARTTLS upgrading over port 587.

SSL & TLS & STARTTLS的更多相关文章

  1. [skill][https][ssl/tls] HTTPS相关知识汇总

    结论前置: A 身份验证 证书, 服务器证书 B 密钥协商 RSA   DHE / ECDHE   PSK C 加密通信 加密通信采用对称加密,使用B阶段协商出来的密钥. B 阶段如果使用 RSA 协 ...

  2. Netty入门(七)使用SSL/TLS加密Netty程序

    为了支持 SSL/TLS,Java 提供了 javax.net.ssl API 的类 SslContext 和 SslEngine 使它相对简单的实现解密和加密.Netty 利用该 API 实现了 C ...

  3. 【转载】python中利用smtplib发送邮件的3中方式 普通/ssl/tls

    #!/usr/bin/python # coding:utf- import smtplib from email.MIMEText import MIMEText from email.Utils ...

  4. Python3中发邮件emal(明文/SSL/TLS三种方式)

    #!/usr/bin/env python #-*- coding:utf-8 -*- #Author:lzd import smtplib from email.mime.text import M ...

  5. 协议森林17 我和你的悄悄话 (SSL/TLS协议)

    作者:Vamei 出处:http://www.cnblogs.com/vamei 转载请先与我联系. TLS名为传输层安全协议(Transport Layer Protocol),这个协议是一套加密的 ...

  6. Paypal开发中遇到请求被中止: 未能创建 SSL/TLS 安全通道及解决方案

    最近在基于ASP.NET上开发了Paypal支付平台,在ASP.NET开发的过程中没有遇到这个问题,但是引用到MVC开发模式中的时候就出现了"未能创建 SSL/TLS 安全通道及解决方案&q ...

  7. 聊聊HTTPS和SSL/TLS协议

    要说清楚 HTTPS 协议的实现原理,至少需要如下几个背景知识.1. 大致了解几个基本术语(HTTPS.SSL.TLS)的含义2. 大致了解 HTTP 和 TCP 的关系(尤其是“短连接”VS“长连接 ...

  8. 浅谈HTTPS和SSL/TLS协议的背景和基础

    相关背景知识要说清楚HTTPS协议的实现原理,至少要需要如下几个背景知识.大致了解几个基础术语(HTTPS.SSL.TLS)的含义大致了解HTTP和TCP的关系(尤其是"短连接"和 ...

  9. 在 ASP.NET MVC 中使用 HTTPS (SSL/TLS) -- 学习

    在 ASP.NET MVC 中使用 HTTPS (SSL/TLS) IS 7如何实现http重定向https HTTPS 升级指南

随机推荐

  1. Java虚拟机性能管理神器 - VisualVM(4) - JDK版本与VisualVM版本对应关系

    Java虚拟机性能管理神器 - VisualVM(4)    -  JDK版本与VisualVM版本对应关系 JDK版本与VisualVM版本对应关系说明 JDK版本与VisualVM版本对应关系 参 ...

  2. C# 指定ip段生成ip地址

    private void button1_Click(object sender, EventArgs e) { string StartIp = ""; string EndIp ...

  3. php + ajax 避免重复提交

  4. RabbitMQ学习笔记(二):基础概念

    前言 上一篇已经通过springboot对rabbitmq的简单封装实现了消息的发送和消费,虽然功能简单,但已经大概了解了它的使用方法.接下来陆续介绍RabbitMQ中的几个核心概念:Queue,Ex ...

  5. pi4j,Netbeans中togglebutton跟Jbutton的区别

    一组togglebutton中会始终有一个是按下去的状态 一组commandbutton就全部都始终都是弹起的状态

  6. 关于jq ajax封装以及ajax上传Webapi

    jq的ajax完整版本 $(function () {     fileChange(); }); function fileChange() {     $('#fileinput').change ...

  7. js pjax 和window.history.pushState,replaceState

    原文:http://blog.linjunhalida.com/blog/pjax/ github:https://github.com/defunkt/jquery-pjax 什么是pjax? 现在 ...

  8. 局域网 ping

    时间:2013-01-15 11:07来源:网络整理 作者:秩名点击:2271次 |我要投稿 一般情况下,如果我们使用Ping命令来查找网络问题所在或检验网络运行情况,我们需要使用许多Ping命令,如 ...

  9. [转]jmeter 自定义测试脚本

    http://blog.csdn.net/kash_chen007/article/details/37690411 http://wangym.iteye.com/blog/731729 1.创建一 ...

  10. Linux同时安装python2和Python3

    我们以Ubuntu 为例,默认地,Linux安装好后会默认安装python2版本: 安装Python3: For Debian:   [user@host]$ sudo apt-get install ...