SSL, TLS and STARTTLS explained
What the encryption options in your mail client actually mean, and which one to choose when setting up a WebGee mailbox.
Every mail client asks you to pick an encryption setting, usually offering
SSL/TLS, STARTTLS and None. This explains what they mean and which to
choose.
Short answer: choose SSL/TLS on port 993 for incoming and port 465 for outgoing. Both options encrypt equally well; SSL/TLS just fails more safely.
The terms
SSL — Secure Sockets Layer. The original protocol. Every version is now considered insecure; SSL 3.0 fell to the POODLE attack in 2014 and has been disabled by default ever since. The name survives in mail client menus out of habit, where "SSL" almost always means TLS underneath.
TLS — Transport Layer Security. SSL's successor and what actually runs today. TLS 1.0 and 1.1 are also retired; TLS 1.2 and 1.3 are current, and WebGee servers accept those.
STARTTLS — not a protocol but a command. It opens an unencrypted connection on the normal port, then asks the server to upgrade it to an encrypted one. Recognised by SMTP, IMAP and POP3.
The practical difference
The distinction is not how strong the encryption is — both end up negotiating the same TLS. It is when encryption starts.
| SSL/TLS (implicit) | STARTTLS (explicit) | |
|---|---|---|
| Port | Dedicated encrypted port | Standard port |
| Encryption begins | Immediately, before anything is sent | After an unencrypted greeting |
| If encryption fails | Connection fails | May silently continue unencrypted |
That last row is the reason to prefer SSL/TLS. With STARTTLS, a client that mishandles a failed upgrade can carry on in plain text, sending your password unencrypted. With SSL/TLS there is no unencrypted state to fall back to.
Which ports
| Purpose | Encryption | Port |
|---|---|---|
| IMAP | SSL/TLS | 993 |
| IMAP | STARTTLS | 143 |
| POP3 | SSL/TLS | 995 |
| POP3 | STARTTLS | 110 |
| SMTP | SSL/TLS | 465 |
| SMTP | STARTTLS | 587 |
Use the bold ones unless something specific stops you. Full settings are in Email server settings.
Never choose None. Your mailbox password is sent in clear text on every check, readable by anyone on the same network.
Why "plain" authentication is not insecure here
Mail clients often ask for an authentication method as well, and the safe choice is called Plain or Normal password. That sounds alarming but is not: encryption is established first, so the password travels inside the encrypted channel. WebGee servers refuse to authenticate over an unencrypted connection at all.
Related
Set up email in Thunderbird
Add your WebGee mailbox to Mozilla Thunderbird, including server-side calendars and address books, which Thunderbird can connect in the same wizard.
Set up email in Windows Mail
Add your WebGee mailbox to the Windows Mail app using Exchange, which also brings your contacts and calendar into the People and Calendar apps.