Glossary
What is an SSL VPN? | ExpressVPN Glossary

Expressvpn Glossary

SSL VPN

What is an SSL VPN?

A Secure Sockets Layer (SSL) virtual private network (VPN) uses Transport Layer Security (TLS) to create secure, encrypted connections over the internet (the term “SSL VPN” is a legacy name, as modern implementations use TLS).

SSL VPNs let remote users access resources on an internal network, either through a web browser or via a lightweight client application. The core purpose is to provide users with secure remote access to private resources.

How does an SSL VPN work?

SSL VPNs establish a secure connection to internal networks by following the below process:

Login: A user initiates a connection from their device to the VPN gateway using a standard web browser or a specialized client application. The connection typically uses HTTPS, which ensures that this initial communication is encrypted.
TLS handshake and secure session creation: The browser and VPN gateway perform a TLS handshake to establish an encrypted connection for future communication and data exchange.
User authentication: The VPN portal prompts the user to authenticate. This process may require a username and password, multi-factor authentication (MFA), or digital certificates, depending on the VPN configuration. The authentication occurs over the encrypted session, keeping credentials safe.
Secure session or tunnel creation: Once the user is authenticated, the SSL VPN establishes a secure session for browser-based access or a secure tunnel for wider device traffic, depending on the type of SSL VPN being used. This connection routes data to the VPN gateway while protecting it with TLS encryption.
Access: The user can now access the network’s internal infrastructure securely through the encrypted connection.

How an SSL VPN works

Types of SSL VPNs

There are two main types of SSL VPNs:

SSL portal VPN

SSL portal VPNs (also referred to as clientless VPNs) allow users to connect to a private network directly through their web browser. They have a web-based login page where users can authenticate themselves; once logged in, the user can begin to send and receive data over the encrypted link with the relevant VPN gateway.

One key downside to SSL portal VPNs is that they’re limited to the browser and don’t encrypt any activity outside it.

SSL tunnel VPN

SSL tunnel VPNs use a client application installed on the user’s device to establish an encrypted tunnel to the VPN gateway. SSL tunnel VPNs provide broader coverage and flexibility than SSL portal VPNs, as the user isn’t forced to work within a web browser.

There are two common types of SSL tunnel VPN: thin-client and full-tunnel. Thin-client SSL VPNs route only selected applications or traffic through the VPN, while other traffic bypasses the tunnel. Full-tunnel SSL VPNs are designed to route all device traffic through the encrypted tunnel, offering maximum security, but requiring more configuration and potentially affecting performance.

Why is an SSL VPN important?

SSL VPNs provide secure remote access to company resources for workers, using tried-and-tested TLS encryption to protect data during transit. In the case of SSL portal VPNs, modern web browsers natively support TLS protocols, enabling immediate connectivity without the need for advanced configuration.

These VPNs also work well in environments with strict firewall rules because they typically use the Transmission Control Protocol (TCP) over port 443 (the same port used for HTTPS traffic). Since blocking port 443 would prevent regular web browsing, firewalls are less likely to block it outright, though some environments may still apply additional inspection or restrictions.

FAQ

Is an SSL VPN secure?

Yes, Secure Sockets Layer (SSL) VPNs use Transport Layer Security (TLS) encryption to secure traffic. However, the overall level of security can differ between different SSL VPN types. SSL portal VPNs only protect browser traffic, while SSL full-tunnel VPNs can secure all external traffic on a given device.

Do I need software to use an SSL VPN?

Secure Sockets Layer (SSL) portal VPNs can work directly through your browser without needing additional software. However, SSL tunnel VPNs require a lightweight client.

What port does an SSL VPN use?

Secure Sockets Layer (SSL) VPNs typically operate over the Transmission Control Protocol (TCP) port 443, the standard port for HTTPS traffic.

Can an SSL VPN replace an IPsec VPN?

It depends on your needs. Secure Sockets Layer (SSL) VPNs are good for remote access to internal networks without the need for complex configuration. Internet Protocol Security (IPsec) VPNs are better suited for site-to-site connections and full network access, but they require more setup.

Is an SSL VPN the same as a regular VPN?

No. A Secure Sockets Layer (SSL) VPN is a specific type of VPN that uses Transport Layer Security (TLS) to allow secure and remote access to internal networks. It can provide either browser-based protection (portal VPN) or partial/full device coverage (tunnel VPN). Regular consumer VPNs aren’t typically suitable for establishing a remote connection with private networks. In addition, they often use other protocols, such as WireGuard or OpenVPN, and usually encrypt all device traffic by default.