Glossary / Developer reference
SSL signature
- Definition
- SSL signature is the name BIP70 gave to the bytes signing a PaymentRequest with a web server's certificate key, and the label was already a misnomer when it was written.
Specified in BIP-70.
No SSL protocol is involved in an SSL signature. The bytes are an ordinary X.509 signature over a serialized message, made with the private key of a TLS server certificate, and the protocol SSL 3.0 was formally prohibited by RFC 7568 in June 2015. Anyone reading old bitcoin documentation should treat the phrase as meaning "certificate signature" and move on.
How it works
Status: the SSL signature died alongside BIP70, the protocol that defined it. Bitcoin Core carried BIP70 from March 2014 until release 0.20.0 dropped it, and no maintained software produces or checks one of these signatures today. The phrase survives in the bitcoin.org developer reference, which is where most people find it.
The algorithm was chosen by a sibling field rather than announced by the signature itself. A payment request declared its pki_type as none, x509+sha256 or x509+sha1. That value named the certificate format and the digest, while the signing algorithm came from whatever key the merchant's certificate happened to carry, in practice RSA. A verifier rebuilt the exact bytes the merchant had signed, hashed them with the named digest, and compared the result against the public key in the first certificate of the attached chain.
Two of the three options aged badly. The x509+sha1 setting was weak before BIP70 was even published, since NIST had disallowed SHA-1 for generating digital signatures after December 31, 2013. By January 2020 researchers demonstrated a chosen-prefix collision against SHA-1 for roughly $45,000 of rented GPU time, which is precisely the attack that lets one signed document be swapped for another. NIST has since set December 31, 2030 as the point where SHA-1 leaves its approved algorithms altogether.
The deeper point is that this signature and a bitcoin signature answer different questions. A signature inside a bitcoin transaction is checked by every node against the consensus rules, over the secp256k1 curve, using ECDSA or, since Taproot activated at block 709,632 on November 14, 2021, Schnorr as specified in BIP340. An SSL signature was checked by one wallet against a certificate store maintained by a vendor. One authorizes the movement of money and cannot be overruled by anybody. The other was an assertion about who was asking for it.
Where you see it
Certificate signatures did not disappear, only the BIP70 field name did. Your browser still watches a server prove possession of its certificate key during a TLS handshake, and that is the honest version of what BIP70 was trying to borrow.
The version worth caring about when you hold bitcoin is code signing. Wallet software and hardware wallet firmware are signed with keys the manufacturer controls, and checking that signature before installing is the step that catches a tampered download. Trezor and Ledger devices verify firmware signatures on the device itself and refuse or loudly flag builds they cannot authenticate. That is a signature doing real work, unlike the BIP70 field, because it defends the keys that hold your coins rather than the name printed on a checkout page.
SSL signature vs digital signature
An SSL signature authorized nothing on the blockchain. A digital signature in a bitcoin transaction unlocks a specific output and is validated independently by thousands of nodes; the BIP70 field was validated by a single piece of client software against a list of certificate authorities. The consequences of losing the key differ just as sharply. A compromised certificate key is revoked and reissued the same afternoon. A compromised bitcoin key means the coins are already gone.