SSL 3.0 (SSLv3, Secure Sockets Layer 3.0)

SSL 3.0 is the final version of the Secure Sockets Layer protocol designed at Netscape, released in 1996 and later documented as the historic RFC 6101. It became the basis for TLS 1.0, and its record layer and handshake shape survive in every later TLS version.

Why it matters

In October 2014 the POODLE attack showed that SSL 3.0's CBC padding cannot be secured: the padding bytes are not covered by the MAC and their content is unspecified, so an attacker who can make a client repeat requests can recover secrets such as cookies byte by byte. The only non-CBC alternative in SSL 3.0 was RC4, itself broken and later prohibited by RFC 7465, which left no safe configuration. Because many clients used to retry failed handshakes with lower versions, an attacker could force a downgrade to SSL 3.0 even when both sides supported TLS. RFC 7568 deprecated SSL 3.0 in June 2015.

Example

Confirm that a server no longer offers SSLv3:

nmap --script ssl-enum-ciphers -p 443 example.com

The output should contain no SSLv3 section. Most current OpenSSL builds cannot even attempt an SSL 3.0 handshake.

Common misconceptions

• "An 'SSL certificate' means the site uses SSL." Certificates are independent of the protocol version. Sites with "SSL certificates" today negotiate TLS 1.2 or 1.3.
• "POODLE only affects clients that prefer SSL 3.0." An active attacker could trigger the fallback, which is why servers had to disable SSL 3.0 entirely; TLS_FALLBACK_SCSV (RFC 7507) was added to block such forced downgrades.
• "SSL 3.0 is acceptable with RC4." RC4 has its own exploitable biases, so neither SSL 3.0 option is safe.