STARTTLS

STARTTLS is an extension to plain text communication protocols, which offers a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate port for encrypted communication. STARTTLS is primarily intended as a countermeasure to passive monitoring.

STARTTLS for IMAP and POP3 is defined in RFC 2595, for SMTP in RFC 3207, for XMPP in RFC 6120, for LDAP in RFC 2830, for NNTP in RFC 4642, and for FTP in RFC 4217. For IRC, the de facto definition is documented at the InspIRCd wiki.

Layering

TLS is application-neutral; in the words of RFC 5246

The style used to specify how to use TLS matches the same layer distinction that is also conveniently supported by several library implementations of TLS. E.g., the RFC 3207 SMTP extension illustrates with the following dialog how a client and server can start a secure session:

The last EHLO command above is issued over a secure channel. Note that authentication is optional in SMTP, and the omitted server reply may now safely advertise an AUTH PLAIN SMTP extension, which is not present in the plain-text reply.