Explicit vs Implicit Security

When using Mail protocols, there are two types of SSL connections:

Implicit SSL
Explicit SSL

Implicit Security

With implicit security, it is understood that both the client and the server will use SSL for the entire session. The client connects, the SSL handshake occurs, and (if successful) secure communication continues for the session. For this reason, implicit SSL typically must use a different port than the well-known port for the protocol. For example:

The well-known implicit port for IMAP over SSL is 993.
The well-known implicit port for POP over SSL is 995.

Note: Implicit SSL, although common, is not formally adopted in an RFC.

Explicit Security

With explicit security, secure communication occurs only after some preliminary negotiation in the clear. The client connects normally to the mail server at the protocol's well-known port and issues the STARTTLS command. If the server supports this mechanism and responds positively, secure communication continues for the rest of the session.

In This Section

Security Overview: Provides an overview of basic security concepts such as digital certificates and authentication.
Creating A Mail Client: Provides a step-by-step set of instructions on how to create a Mail client.
Handling Client Authentication.: Demonstrates how to use a certificate to authenticate the client to the server.
Explicit vs Implicit Security: Discusses the differences between using explicit and implicit SSL.
Using The CertificateListForm Object: Demonstrates how to use the CertificateListForm to assist users in selecting a certificate.
Using MMC To Manage SSL Certificates: Discusses how to use the Microsoft Management Console to manage SSL certificates.
Windows 95/98 Security Compatibility: Discusses compatibility issues with Windows 95 and 98.

Send comments on this topic.

Documentation version 3.1.