SSL (Secure Sockets Layer)

SSL is the protocol family Netscape created in the mid-1990s to encrypt and authenticate traffic between browsers and web servers. SSL 1.0 was never released publicly, SSL 2.0 shipped in 1995 and SSL 3.0 in 1996; the IETF then standardised the design as TLS 1.0 in 1999. Every SSL version is now broken and prohibited, yet "SSL" survives as everyday shorthand for TLS, certificates and HTTPS in general.

Why it matters

When someone asks for an "SSL certificate" or an "SSL checker", they almost always mean TLS. The distinction still matters in configuration: a server that accepts SSL 3.0 is exposed to POODLE, and RFC 7568 formally deprecated SSL 3.0 in 2015. Modern servers should offer only TLS 1.2 and TLS 1.3. Library names such as OpenSSL and BoringSSL, and directives such as nginx's ssl_protocols, keep the old name purely for historical reasons.

Example

In nginx the directive is still called ssl_protocols, but the values you list should be TLS versions only:

ssl_protocols TLSv1.2 TLSv1.3;

Common misconceptions

• SSL and TLS are competing products you must choose between. They are successive versions of one protocol line; anything sold or configured as "SSL" today actually runs TLS.
• An SSL certificate only works with the SSL protocol. Certificates are protocol-independent X.509 documents; the same certificate is used with TLS 1.2 and TLS 1.3.
• Turning off SSL 3.0 will lock out normal visitors. Mainstream browsers stopped using SSL 3.0 after POODLE was published in 2014, so disabling it has no effect on real users.