Can I use ssl:// and https:// in an URL interchangeably?

Question

I have to write some PHP code to make a post request to an external server and got two different examples from the server owners, one using "ssl://" and the other "https://" in the URL.

Can they be used interchangeably? Where would this be documented? Thank you!

EDIT to include PHP code (not sure why I can't format the code properly, if someone can help with explaining how to incorporate the initial comment in the code block):

// make a http post request to an external server
function httpPost($host, $usepath, $postdata = "") {

    $fp = fsockopen($host, 443, $errno, $errstr, 60);
    if( !$fp ) {
        print "$errstr ($errno)<br>\n";
    }
    else {
        fwrite( $fp, "POST $usepath HTTP/1.0\n");
        $strlength = strlen( $postdata );
        fwrite( $fp, "Content-type: application/x-www-form-urlencoded\n" );
        fwrite( $fp, "Content-length: ".$strlength."\n\n" );
        fwrite( $fp, $postdata."\n\n" );

        $output = "";

        while( !feof( $fp ) ) {
            $output .= fgets( $fp, 1024);
        }

        fclose( $fp);
    }

    return $output;
}

Answer 1

ssl:// URLs are quite specific to PHP. It's the way PHP provides a way to use a direct SSL/TLS connection when using its fsocketopen function. See List of Supported Socket Transports in the manual.

ssl:// will give you an SSL/TLS connection without any application protocol on top of it: it will be up to your application to implement whichever protocol you require for the communication.

In contrast, https:// will implement the HTTP protocol over this SSL/TLS connection.

Note that the default settings for ssl:// and tls:// are rather poor in terms of security. In particular, the default value for verify_peer is false, which would make the connection vulnerable to MITM attacks.

Answer 2

HTTPS is HTTP protocol encrypted with SSL. A POST request is defined in the HTTP protocol, therefore you should use https:// for that.

Looking at IANA's list of URI schemes, I did not see ssl://, therefore I would suggest against using it in any situation.