Secure Sockets Layer
DeprecatedDeprecated cryptographic protocol developed by Netscape in 1995. All versions (SSL 2.0, SSL 3.0) have critical vulnerabilities and are prohibited by RFC 7568. The modern replacement is TLS (Transport Layer Security).
In one line
SSL (Secure Sockets Layer) is the deprecated predecessor of TLS. Netscape created SSL 2.0 (1995) and SSL 3.0 (1996) to encrypt web traffic. SSL 3.0 was broken by the POODLE attack (CVE-2014-3566) and prohibited by RFC 7568 in 2015. All modern systems use TLS 1.2 or TLS 1.3. The term 'SSL certificate' persists as industry habit but the protocol is always TLS.
Quick Reference
| Field | Size | Description |
|---|---|---|
| Status | Deprecated – do not use | |
| Replaced by | TLS 1.2 (RFC 5246) and TLS 1.3 (RFC 8446) | |
| Prohibited | RFC 7568 (SSL 3.0), RFC 6176 (SSL 2.0) | |
| Known attacks | POODLE, DROWN, BEAST, CRIME |
Key Characteristics
Deprecated
All SSL versions have critical vulnerabilities. No modern software accepts SSL connections.
POODLE Attack
SSL 3.0 CBC padding oracle attack allows decryption of encrypted data. Disclosed 2014.
Replaced by TLS
TLS 1.0 was SSL 3.1 renamed. TLS 1.2 and 1.3 are the current standards.
Naming Confusion
"SSL certificates" are X.509 certificates used with TLS. The protocol is TLS, not SSL.