SSH vs. SSL/TLS: What's the Difference?
-
SSH and SSL/TLS both encrypt connections, but they protect different things: SSH secures remote access to a server, while SSL/TLS secures websites and other services. Here's how they differ and whether SSH needs an SSL certificate.
- Automatic renewals
- Less manual work
-
-
*
SSH vs. SSL/TLS at a Glance
SSH SSL/TLS Main purpose Remote access to servers and file transfer Securing websites, email, APIs, and other services Default port 22 443 for HTTPS; other ports for email and other services How the server proves its identity Its own host key, which the client remembers A certificate issued by a trusted certificate authority How the client proves its identity Password or SSH key, always required Usually not at all; a client certificate in mTLS Who uses it Administrators and developers Everyone who opens a website -
*
How Trust Works in SSH
SSH (Secure Shell) lets you log in to a server and run commands on it as if you were sitting in front of it. Instead of a certificate from a certificate authority, every SSH server has its own key pair, called a host key. The first time you connect, your SSH client shows the key's fingerprint and asks whether to trust it:
The authenticity of host 'example.com (203.0.113.10)' can't be established. ED25519 key fingerprint is SHA256:Xg5w0nRk3q7HzJvT2bP8cLmA9sYdE1fKuW4oNiQ6rVc. Are you sure you want to continue connecting (yes/no/[fingerprint])?
If you confirm, the client saves the key and checks it on every later connection. If the key ever changes, SSH shows a REMOTE HOST IDENTIFICATION HAS CHANGED warning, which can mean that someone is intercepting the connection.
Users then log in with a password or, more securely, with an SSH key pair: the private key stays on the user's computer, and the public key is added to the server. Besides remote administration, SSH is used for transferring files with SFTP and SCP and for creating secure tunnels to other services.
-
*
What They Have in Common
Under the hood, both protocols work in a similar way. They start with a handshake in which both sides agree on encryption methods and create shared keys, then encrypt all data with fast symmetric encryption and check that nothing was changed in transit. For how this works in TLS, see SSL/TLS Handshake: How It Works Step by Step .
-
*
Do You Need an SSL Certificate for SSH?
Important: No. SSH doesn't use SSL certificates, so installing one on your server doesn't affect SSH in any way. SSH is protected by the server's host key and by the passwords or SSH keys of its users.
A common source of confusion is file transfer, where two protocols have similar names:
- SFTP (SSH File Transfer Protocol) runs over SSH and doesn't use an SSL certificate.
- FTPS (FTP over SSL/TLS) is regular FTP protected with TLS. It needs an SSL certificate, just like a website.
-
*
How They Work Together
In practice, you'll often use both. Administrators connect to a server over SSH to generate a CSR, upload certificate files, and configure the web server, which then uses the SSL certificate to protect visitors over HTTPS. For an example, see How to Generate an ECC CSR and Private Key for Apache .
-
