Opportunistic TLS

Opportunistic TLS (Transport Layer Security) refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate port for encrypted communication. Several protocols use a command named "STARTTLS" or "Explicit TLS" for this purpose. It is a form of opportunistic encryption and is primarily intended as a countermeasure to passive monitoring.

The STARTTLS command for IMAP and POP3 is defined in RFC2595, for SMTP in RFC3207, for XMPP in RFC6120 and for NNTP in RFC4642. For IRC, the IRCv3 Working Group defined a STARTTLS extension, though it was later deprecated. FTP uses the command "AUTH TLS" defined in RFC4217 and LDAP defines a protocol extension OID in RFC2830. HTTP uses an upgrade header.