What Are SSL and TLS?

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are both protocols used to encrypt online communication. They define a standard for how client and server should communicate and agree on how best to secure and encrypt the data between them.

If you want to know what SSL/TLS certificates are, you can read more here.

  • SSL 1.0 was dropped before release because it contained obvious vulnerabilities.
  • SSL 2.0 was released in 1995, but vulnerabilities were found quickly and it is blocked everywhere today.
  • SSL 3.0, a complete rewrite, arrived as early as 1996 and held up until 2014 when the POODLE vulnerability was published.

Since 2015, the recommendation has been to avoid SSL 2.0/SSL 3.0 entirely and use TLS instead, which is more of an "SSL 4.0" than a complete rewrite like SSL 3.0 was.

TLS also has multiple versions, where each version builds on the previous one by adding new features and capabilities to counter new or potential future vulnerabilities found in older protocols. TLS is backward compatible but intentionally blocks SSL 2.0/3.0.

  • TLS 1.0 released in 1999
  • TLS 1.1 released in 2006
  • TLS 1.2 released in 2008
  • TLS 1.3 released in 2018

For servers that only support older TLS versions, such as TLS 1.0, it is possible to prevent vulnerabilities by changing the server configuration and, for example, removing a broken encryption algorithm. You cannot determine whether a server is insecure based on the TLS version alone, unlike with SSL 2.0/SSL 3.0.

Credit card providers, banks, and other security-focused organizations send a clear signal that TLS 1.2 should be used.