When using Mail protocols, there are two types of SSL connections:
- Implicit SSL
- Explicit SSL
Implicit Security
With implicit security, it is understood that both the client and the server will use SSL for the entire session. The client connects, the SSL handshake occurs, and (if successful) secure communication continues for the session. For this reason, implicit SSL typically must use a different port than the well-known port for the protocol. For example:
- The well-known implicit port for IMAP over SSL is 993.
- The well-known implicit port for POP over SSL is 995.
- The well-known implicit port for SMTP over SSL is 465.
Note: Implicit SSL, although common, is not formally adopted in an RFC.
Explicit Security
With explicit security, secure communication occurs only after some preliminary negotiation in the clear. The client connects normally to the mail server at the protocol's well-known port and issues the STARTTLS (IMAP and SMTP) or STLS (POP) command. If the server supports this mechanism and responds positively, secure communication continues for the rest of the session.