Conclusion

TLS fulfills the security objectives expected of it: it is capable of ensuring mutual authentication of actors, confidentiality, and the spatial and temporal integrity of transactions. Naturally, this does not come without interference from the environment: to sum up the essentials, the application that embeds it and the certificate management policy are of critical importance if a reasonable level of security is to be achieved.

This is why TLS can be said to be a secure protocol in terms of its construction and mechanisms, but weak in terms of authentication: unable to do better than the Internet, it offers only passable resistance to active attacks. Of course, this is a theoretical verdict, and the reality leaves relatively few opportunities for attackers to take advantage of it. After several years of service and widespread use, SSL/TLS has not suffered any devastating...