In the 1990s there were two competing designs for securing web traffic. The first, S-HTTP, encrypted each individual HTTP request and response as its own separate message. The second, SSL, encrypted the entire connection itself, so every request, cookie, and form field sent over that session was protected without any extra per-message handling. The second design became HTTPS, and it won decisively. S-HTTP was abandoned and today exists mainly as an exam answer for the question “which protocol is an obsolete method for securing web traffic.” The trap sitting next to it is S/MIME, which has nothing to do with web traffic at all: it signs and encrypts email messages and their attachments, and it is still in active use. The exam distinction is therefore simple to hold onto: S-HTTP is the retired web protocol, and S/MIME is the living email protocol. If you match each protocol to the traffic it protects, the confusion disappears.
The same pattern of retirement and replacement runs through most of the Security+ protocol objectives, and it is worth memorizing as a set. SSL 2.0, SSL 3.0, and TLS 1.0/1.1 are formally deprecated, leaving TLS 1.2 and 1.3 as the current standard. Telnet handed its job to SSH, plain FTP to SFTP or FTPS, WEP to WPA2 and WPA3, and SNMP versions 1 and 2c to SNMPv3. The secure variants also carry well-known ports that are fair game on the exam: HTTPS on 443, LDAPS on 636, IMAPS on 993, POP3S on 995, and SMTP over TLS on 587. For any protocol you encounter, ask three questions: is it deprecated, what replaced it, and what traffic was it designed to protect. Answering those three lets you classify nearly any protocol on the exam instead of guessing.
Leave a Reply