What is the difference between STARTTLS and implicit TLS (SMTPS, LDAPS)?

Short answer

There are two ways to protect a protocol with TLS. In implicit TLS, the connection is TLS from the first byte and a separate port is usually used: for example SMTPS (465), LDAPS (636). In STARTTLS, the connection starts unencrypted and is upgraded to TLS on the same port with the protocol's own command: it is common on ports 25 and 587 in SMTP and on port 389 in LDAP. In TR7, the two methods are encountered in Health Checks profiles: in the SMTP check, Use STARTTLS upgrades the connection to TLS; the SMTPS and LDAPS checks set up the connection directly with TLS.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks → Check type = SMTP	Use STARTTLS (off by default)	Checking an SMTP connection that starts unencrypted by upgrading it to TLS with STARTTLS; when it is turned on, TLS fields (e.g. Verify Server Certificate, Virtual Domain (Host/SNI)) are added to the form
Health Checks → Check type = SMTPS	-	Setting up the connection directly with TLS; Use STARTTLS is not present in this type
Health Checks → Check type = LDAPS	-	Setting up the LDAP connection directly with TLS
L7 TCP vService → Frontend	Protocol: TCP + TLS, TCP	TCP + TLS terminates, on TR7, implicit TLS, where the connection is TLS from the first byte; connections that switch to TLS later with STARTTLS are carried without being decrypted when TCP is selected

Comparison

	STARTTLS	Implicit TLS
Start	Unencrypted; the switch to TLS is made with a protocol command	TLS from the first byte
Port	The normal port of the protocol (SMTP 25/587, LDAP 389)	Usually a separate port (SMTPS 465, LDAPS 636)
Example	SMTP + STARTTLS (RFC 3207), LDAP StartTLS (RFC 4513)	SMTPS (RFC 8314), LDAPS
Risk	If the upgrade is not made mandatory, someone in the middle can block STARTTLS and leave the connection unencrypted	Since the connection does not start unencrypted, this risk does not exist

Common Misconceptions

• "STARTTLS uses weaker encryption than implicit TLS." After the upgrade, the encryption is the same; the risk lies in configurations where the upgrade is not made mandatory.
• "LDAPS and LDAP with StartTLS use the same port." LDAPS usually runs on 636, and LDAP with StartTLS on 389.
• "Use STARTTLS can also be turned on in the SMTPS check." Since SMTPS already starts the connection with TLS, the Use STARTTLS option is not present in this type; the option exists only in the SMTP type.

How it is done in the documentation

• Health Checks · Use STARTTLS
• Health Checks · SMTPS
• Health Checks · LDAPS

Related questions

• Can authenticated / STARTTLS checks be done for LDAP, SMTP and FTP?
• What is SSL passthrough; when should I use passthrough instead of termination?
• Is there a difference between TCP + TLS termination on L7 TCP and termination on an HTTP vService?