Are SSL and TLS certificates the same?

What is the major difference between TLS and SSL?

I have used both for about 6 years and TLS is basically SSL/TLS, but newer.

it uses P1363 for the underlying transport security mechanisms. It's easier to remember than SSL/TLS.

And what's the difference between a SslStream and just using an HttpWebRequest? I was unable to find anything useful on Wikipedia or other Web sites, so I decided to answer this question based on what I learned from the book "Windows TCP/IP Internals". The main difference between these protocols is how security is implemented in them. The older SSL protocol doesn't provide any mechanism to encrypt the data transfer, which is where TLS comes into play. On top of that, an attacker needs to be able to sniff out the TLS negotiation message before being able to read the data being transferred. For this reason, the old SSL protocol uses an RSA keypair generation method, but TLS makes use of symmetric keys (RSA is asymmetric). Although TLS also has forward secrecy and some other benefits over SSL, the best answer to your question appears to be "no".

What does SSL TLS accept all certificates mean?

Does that mean that all certificate authorities will be trusted?

If a PKI system has the root and subordinate CA certificates, then the CA certificates themselves are installed on the user's machine by the PKI application or the operating system or both. A client should verify that the identity of the remote server is signed by a trusted root CA certificate as part of any TLS connection. Since this is not always done, an attack is possible where the attacker uses man-in-the-middle techniques (MITM) to intercept the client's request, modify the certificate sent to the remote server, and resend it to the remote server with an altered identity that the remote server does not recognize and accepts.

More information about MITM can be found in How does SSL work? Also, if you use a chain of trusted root CA certificates, then all the CA certificates (the intermediate CA certificates) are installed on the user's machine, so a MITM attack is prevented. The client does not have to accept or verify any certificate except the root CA; any intermediate CA certificates are used only by the operating system or some PKI applications. The root CA certificate provides the public key for signatures on the other CA certificates and a digital signature over itself. This signature provides the basis for verifying the validity of the tree of CA certificates from the root down.