In short: TLS (Transport Layer Security) is the successor to SSL (Secure Sockets Layer). Both serve the same purpose: they encrypt the connection between the browser (or an email client) and the server, and verify that the visitor is indeed connecting to the intended server. All versions of SSL are now obsolete and vulnerable; today, websites, email and almost all encrypted internet connections use TLS. Nevertheless, the term ‘SSL’ has remained in common parlance, and certificates are still referred to by this name.

How did SSL become TLS?

SSL was developed by Netscape in the mid-1990s for its own web browser. Version 1.0 was never released; SSL 2.0 was released in 1995, and the improved SSL 3.0 in 1996. Thereafter, responsibility for the protocol was taken over by the IETF, the standards-setting body, which released the next version under a new name: TLS 1.0 was released in 1999. This was essentially a further development of SSL 3.0; within the protocol, the version number remained 3.1, and the name changed only because the standard had changed hands.

Version	Publication	Current status
SSL 2.0	1995	Banned since 2011 (RFC 6176)
SSL 3.0	1996	Banned since 2015 (RFC 7568), following the POODLE attack
TLS 1.0	1999	Obsolete since 2021 (RFC 8996); browsers disabled this feature in 2020
TLS 1.1	2006	Obsolete since 2021 (RFC 8996); browsers disabled this feature in 2020
TLS 1.2	2008	It is secure if the server only allows strong encryption
TLS 1.3	2018	the current version

What is the difference in practice?

SSL and older versions of TLS had to be phased out not because of their names, but because of their outdated algorithms. Each new version has addressed the vulnerabilities of its predecessors:

• TLS 1.0 introduced stronger message authentication (HMAC) and key derivation compared to SSL 3.0, but it was based on the older CBC mode of encryption, which was later exploited by several attacks (such as BEAST).
• TLS 1.1 fixed some of these issues, but did not represent a major breakthrough, which is why it has not become widely adopted.
• TLS 1.2 introduced modern, authenticated encryption (such as AES-GCM) and SHA-256-based key derivation. It is still widely used today and is secure provided the server does not permit the use of older, weak encryption methods (such as RC4, 3DES, CBC and static RSA key exchange).
• TLS 1.3 has been greatly simplified: the old algorithms have been completely removed, making it harder to configure incorrectly. Every connection is protected by forward secrecy, meaning that even if the server’s private key is compromised at a later date, previously recorded traffic cannot be decrypted. The connection setup (the handshake) is shorter, involving a single round-trip of messages, which speeds up page loading, particularly on mobile networks, and the server’s certificate is also transmitted in encrypted form.

The article ‘What is TLS (Transport Layer Security)?’ explains the handshake and encryption process step by step.

So why do we call it an SSL certificate?

Out of habit. The certificate (X.509 certificate) is not specific to any protocol version: the same certificate works with both TLS 1.2 and TLS 1.3, and would have worked in exactly the same way with SSL 3.0 in the past. The certificate merely verifies that the public key belongs to the domain; the protocol version and encryption method used to establish the connection are determined by the settings of the server and the browser.

This is why there is no separate ‘TLS certificate’: if a provider sells an SSL, TLS or SSL/TLS certificate, they are all referring to the same product. The real difference between certificates lies in the level of validation (DV, OV, EV) and the number of domains they cover; you can read about these on our page showcasing our SSL certificates and in the article ‘What is an SSL certificate, and why do I need one?’. Our blog post summarises why it is now mandatory for every website.

SSL/TLS and STARTTLS in email clients

In email client settings, ‘SSL/TLS’ and ‘STARTTLS’ do not refer to the protocol version, but rather to how encryption is initiated:

• SSL/TLS (implicit TLS): the connection is encrypted from the very start. This is used by IMAP on port 993, POP3 on port 995 and outgoing SMTP on port 465.
• STARTTLS: the connection starts unencrypted, then the program switches to an encrypted connection in the first step. This is used by the outgoing SMTP service on port 587.

In both cases, traffic is encrypted using TLS; neither refers to the older SSL standard. However, do not select the ‘None’ or ‘No encryption’ setting, as your password will then be transmitted in plain text. For more information on email security, see: Is email secure?

Which version should I enable?

On a website today, it is advisable to enable TLS 1.2 and TLS 1.3, but not the older versions. There is no need to disable TLS 1.2 just yet: some older systems and programs only recognise this one of the two. Disabling TLS 1.0 and 1.1, however, effectively excludes no one: modern browsers do not use them, and only systems dating from before the early 2010s (such as Windows XP) are unable to connect using TLS 1.2. The PCI DSS standard, which applies to online shops accepting credit card payments, has not permitted the use of SSL or TLS 1.0 since 2018.

If you are running your own server, you will need to carry out the configuration yourself; this guide explains how to configure SSL on an Apache web server.

How can you check which version a website is using?

In Firefox: click on the padlock icon in the address bar, then select ‘Secure connection’ and ‘More information’. The ‘Technical details’ section of the window that opens shows the protocol version (for example, ‘TLS 1.3’) and the encryption method.

From the command line (on Linux and macOS), curl displays the type of connection that has been established:

curl -sv -o /dev/null https://pelda.hu 2>&1 | grep -i "SSL connection"

The answer is, for example, an SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384.

These methods simply show which version your connection was established using. It is difficult to test whether the server accepts older versions from your own computer, as modern browsers and newer versions of OpenSSL block TLS 1.0 and 1.1 even on their own websites. This is where Qualys’ free SSL Server Test page comes in: the ‘Configuration’ section lists which protocol versions the server allows.