Ssl – ny point in running SSL and encryption for email

Yes, it can be done as the two services are listening on different ports.

I'm not familiar with the specifics of doing so with either VSFTPD or Apache though sorry.

You just have to ensure both VSFTPD and Apache are using the same private key as well as the cert itself (and potentially any intermediate root certs that come in to play with your SSL certificate - if you didn't need to install one for apache, you shouldn't need to for VSFTPD either). Yes, the domain will have to be the same to avoid any cert errors.

SSLv2 and SSLv3 are completely different (and both are now considered insecure). SSLv3 and TLSv1.0 are very similar, but have a few differences.

You could consider TLSv1.0 as SSLv3.1 (in fact that's what happens within the records exchanged). It's just easier to compare the TLSv1.0 with TLSv1.1 and TLSv1.2 because they've all been edited within IETF and follow more or less the same structure. SSLv3 being edited by a different institution (Netscape), it makes it a bit more difficult to spot the differences.

Here are a few differences, but I doubt I can list them all:

• In the ClientHello message (first message sent by the client, to initiate the handshake), the version is {3,0} for SSLv3, {3,1} for TLSv1.0 and {3,2} for TLSv1.1.
• The ClientKeyExchange differs.
• The MAC/HMAC differs (TLS uses HMAC whereas SSL uses an earlier version of HMAC).
• The key derivation differs.
• The client application data can be sent straight after sending the SSL/TLS Finished message in SSLv3. In TLSv1, it must wait for the server's Finished message.
• The list of cipher suites differ (and some of them have been renamed from SSL_* to TLS_*, keeping the same id number).
• There are also differences regarding the new re-negotiation extension.

I would strongly recommend Eric Rescorla's book - SSL and TLS: Designing and Building Secure Systems, Addison-Wesley, 2001 ISBN 0-201-61598-3, if you really want more details. I've learnt about some of the points mentioned above from this book. The author occasionally mentions the differences between SSLv3 and TLS (v1.0 only at the time the book was written) when explaining some of the SSL/TLS message, but you do need the background explanation about these messages to have a chance to understand (and it's not appropriate to copy/paste from this book here).