SSL vs TLS
SSL and TLS are successive versions of the same protocol lineage. Netscape created SSL 2.0 (1995) and SSL 3.0 (1996). The IETF standardized the protocol as TLS 1.0 (1999), which is effectively SSL 3.1 with minor changes. TLS 1.1, 1.2, and 1.3 followed with progressively stronger security. SSL 3.0 was broken by POODLE (2014) and all SSL versions are now prohibited by RFC 7568. The naming confusion persists because 'SSL' became the generic term for website encryption. Certificate authorities still sell 'SSL certificates' that work with TLS. OpenSSL is named after SSL. But the protocol running on modern websites is always TLS 1.2 or 1.3 – never SSL.
SSL (Secure Sockets Layer) is the deprecated predecessor of TLS (Transport Layer Security). All SSL versions (2.0, 3.0) have critical vulnerabilities and are disabled in modern software. TLS 1.2 and 1.3 are the current standards. When people say 'SSL certificate' they mean a TLS certificate – the term persists from habit.
| Feature | SSL | TLS |
|---|---|---|
| Latest version | SSL 3.0 (1996) – deprecated | TLS 1.3 (2018) – current standard |
| Security status | Broken – POODLE, BEAST, DROWN attacks | TLS 1.2+ considered secure with proper config |
| Handshake RTT | SSL 3.0: 2 RTT | TLS 1.2: 2 RTT, TLS 1.3: 1 RTT (0-RTT resumption) |
| Cipher suites | RC4, DES, 3DES, MD5 – all broken | AES-GCM, ChaCha20-Poly1305, SHA-256+ |
| Forward secrecy | Optional (rarely used in SSL era) | Mandatory in TLS 1.3 (ephemeral DH/ECDH only) |
| Certificate validation | Basic X.509 chain validation | OCSP stapling, CT logs, certificate transparency |
| Renegotiation | Insecure renegotiation (CVE-2009-3555) | Secure renegotiation (RFC 5746) or removed in TLS 1.3 |
| Record protocol | MAC-then-encrypt (vulnerable to padding oracles) | AEAD ciphers (encrypt-then-MAC or authenticated encryption) |
| Browser support | Disabled in all modern browsers since 2015 | TLS 1.2+ required by all browsers |
| Compliance | PCI DSS prohibits SSL since June 2018 | TLS 1.2+ required for PCI, HIPAA, FedRAMP |
| RFC | RFC 6101 (historic) | RFC 8446 (TLS 1.3) |
When to use SSL
Never. SSL should not be used for any purpose. All SSL versions have critical vulnerabilities. If a system only supports SSL, it must be upgraded or isolated.
When to use TLS
Always. Use TLS 1.3 where possible (faster handshake, mandatory forward secrecy, no legacy cipher negotiation). Fall back to TLS 1.2 with AES-GCM and ECDHE for clients that do not yet support 1.3. Disable TLS 1.0 and 1.1.
Common Mistakes
- Saying 'SSL certificate' when you mean TLS certificate – the certificate itself is protocol-agnostic (X.509). It works with any TLS version. The naming is a historical artifact.
- Keeping TLS 1.0/1.1 enabled 'for compatibility' – these versions are deprecated (RFC 8996) and vulnerable. All modern clients support TLS 1.2+.
- Configuring cipher suites that include CBC mode without checking for padding oracle resistance – use AEAD ciphers (GCM, ChaCha20-Poly1305) exclusively.
- Not enabling HSTS after deploying TLS – without it, the first request can be intercepted and downgraded to HTTP via sslstrip attacks.
- Using RSA key exchange instead of ECDHE – RSA key exchange provides no forward secrecy. A compromised private key decrypts all past traffic.
FAQ
Is SSL 3.0 still used anywhere?
Effectively no. All major browsers disabled SSL 3.0 in 2014-2015 after POODLE. PCI DSS banned it in 2015. Legacy embedded devices (old payment terminals, SCADA) may still use it but should be network-isolated.
What is the difference between TLS 1.2 and 1.3?
TLS 1.3 removes all legacy algorithms (RSA key exchange, CBC, SHA-1), reduces handshake to 1 RTT (0-RTT for resumption), and mandates forward secrecy. It is faster and more secure with fewer configuration pitfalls.