Secure Sockets Layer ( SSL)   TEC 236
Description
SSL provides endpoint authentication and communications privacy over the Internet using cryptography. In typical use, only the server is authenticated (i.e. its identity is ensured) while the client remains unauthenticated; mutual authentication requires public key infrastructure (or PKI) deployment to clients. The protocols allow client/server applications to communicate in a way designed to prevent eavesdropping, tampering, and message forgery.
History and development
Developed by Netscape, SSL version 3.0 was released in 1996, which later served as a basis to develop TLS version 1.0, an IETF standard protocol first defined in RFC 2246. Visa, MasterCard, American Express and many leading financial institutions have endorsed SSL for commerce over the Internet.
SSL operates in modular fashion: its authors designed it for extendability, with support for forwards and backwards compatibility and negotiation between peers.
Applications:
SSL runs on layers beneath application protocols such as HTTP, SMTP and NNTP and above the TCP transport protocol, which forms part of the TCP/IP protocol suite. While it can add security to any protocol that uses reliable connections (such as TCP), it is most commonly used with HTTP to form HTTPS. HTTPS is used to secure World Wide Web pages for applications such as electronic commerce. It uses public key certificates to verify the identity of endpoints.
While an increasing number of client and server products can support SSL natively, many still do not. In these cases, a user may wish to use standalone SSL products like Stunnel to provide encryption. However, the Internet Engineering Task Force recommended in 1997 that application protocols offer a way to upgrade to TLS from a plaintext connection, rather than use a separate port for encrypted communications - this prevents use of wrappers such as Stunnel.
SSL can also be used to tunnel an entire network stack to create a VPN, as is the case with OpenVPN
Early weak keys
Some early implementations of SSL could use a maximum of only 40-bit symmetric keys because of US government restrictions on the export of cryptographic technology. The US government explicitly imposed a 40-bit keyspace small enough to be broken by brute-force search by law enforcement agencies wishing to read the encrypted traffic, while still presenting obstacles to less-well-funded attackers. A similar limitation applied to Lotus Notes in export versions. After several years of public controversy, a series of lawsuits, and eventual US government recognition of changes in the market availability of 'better' cryptographic products produced outside the US, the authorities relaxed some aspects of the export restrictions. The 40-bit key size limitation has mostly gone away. Modern implementations use 128-bit (or longer) keys for symmetric key ciphers.
Incorrect uses
Some websites have been criticized for incorrectly using SSL and therefore negating the security benefits. 

Such incorrect uses include:
Only securing the form submission page, while failing to secure the login page.
Displaying a secure page mixed with non-secure media.
This practice has been found present in many commercial websites such as those of Bank of America and Washington Mutual.