Skip to content
uencoder

SSL

SSL (Secure Sockets Layer) is the early security protocol designed by Netscape; it has been replaced by TLS, though the name survives colloquially.

Purpose

It provided an encryption layer for HTTP and other protocols and is the predecessor of TLS.

Mechanism

SSL 2.0 (1995) and 3.0 (1996) are both deprecated and vulnerable to attacks such as POODLE. TLS 1.0 improved on SSL 3.0. Today's "SSL certificates" are really TLS certificates. SSL should be disabled entirely, enabling only TLS 1.2+.

Use cases

  • Historical HTTPS (deprecated)
  • Legacy system compatibility
  • Colloquial shorthand for TLS
  • Education (contrasted with TLS)

Examples

  • Input 
    SSL 3.0
    Output 
    Deprecated; use TLS 1.3

    The POODLE attack

Common errors

SSL 3.0 is still enabled
Disable all SSL versions and use TLS 1.2+ only

Related terms

TLS
TLS (Transport Layer Security) provides encryption, integrity, and authentication at the transport layer; it replaced SSL and underpins HTTPS, SMTPS, and more.
GLOSSARY
HTTPS
HTTPS is HTTP over TLS: it encrypts HTTP communication at the transport layer, providing confidentiality, integrity, and server authentication, and it is the modern web standard.
GLOSSARY
X.509 Certificate
An X.509 certificate binds a public key to an identity, signed by a CA for verification, containing validity, issuer, subject, and extension fields.
GLOSSARY

References