You have probably already come across the two acronyms SSL and TLS, which are often combined as SSL/TLS. If you want to manually configure an email client or host website, for example, these terms cannot be avoided. In this article, you will learn what the dif­fer­ences between these two protocols are.

Cheap domain names – buy yours now
  • Free website pro­tec­tion with SSL Wildcard included
  • Free private re­gis­tra­tion for greater privacy
  • Free Domain Connect for easy DNS setup

What does SSL and TLS mean?

SSL stands for “Secure Socket Layer” and TLS for “Transport Layer Security”. Both are en­cryp­tion protocols for the internet’s transport layer. Their job is to encrypt data streams between the client and server.

If com­mu­nic­a­tion passes through this encrypted transport layer, an “s” is added to the end of the protocol name: http becomes https, imap becomes imaps, etc. The acronym SSL also appears in the term SSL cer­ti­fic­ate – this cer­ti­fic­ate is required if a website wants to com­mu­nic­ate using https, which is what the vast majority of websites use today.

Tip

For more in­form­a­tion about TLS, check out our follow-up article.

The dif­fer­ence between SSL and TLS

SSL was in­tro­duced in 1995. After a number of serious security vul­ner­ab­il­it­ies were dis­covered, the improved version 2.0 was released, followed by version 3.0 one year later. After dis­cov­er­ing security vul­ner­ab­il­it­ies, the IETF (Internet En­gin­eer­ing Task Force, re­spons­ible for further de­vel­op­ing the internet) rejected SSL 3.0.

Note

SSL 2.0 and SSL 3.0 are sometimes also called SSLv2 and SSLv3.

The TLS protocol is the successor to SSL. It was in­tro­duced in 1999 as an improved version of SSL 3.0 and was called SSL 3.1 at first. The current version is TLS 1.3 (as of 2018).

The jump from SSL 3.0 to TLS 1.0 was initially just a small one. “The dif­fer­ences between this protocol and SSL 3.0 are not dramatic, but they are sig­ni­fic­ant enough that TLS 1.0 and SSL 3.0 do not in­ter­op­er­ate” (RFC 2246). Compared to SSL 3.0, TLS 1.0 improved cryp­to­graph­ic security and ap­plic­a­tion in­ter­op­er­ab­il­ity. The currently used version TLS 1.2 provides increased security against hacker attacks and allows ap­plic­a­tions much more flex­ib­il­ity with regard to the en­cryp­tion used (cipher suites).

The current version of TLS is more secure, flexible, and efficient than its pre­de­cessor SSL. Since the acronym SSL is still much more widely known than TLS, many providers of client software, routers, and so forth use the term SSL or al­tern­at­ively the combined term SSL/TLS. However, this is usually referring to the current version of TLS (i.e. TLS 1.3).

SSL or TLS – which one should you use?

Today, the only answer is TLS. SSL 2.0 and SSL 3.0 are outdated and regarded as insecure. The same can be said about older versions of TLS. Only TLS 1.2 can still be used under certain con­di­tions, which are outlined in the TLS 1.3 spe­cific­a­tion. However, you should avoid all SSL protocols (as using them is now pro­hib­ited) as well as TLS versions 1.0 and 1.1 (support for which will be phased out soon). On properly con­figured servers, these outdated protocols are disabled.

Image: Screenshot of GlobalSign
Example of a proper server con­fig­ur­a­tion: only TLS 1.2 is activated. Source: https://glob­alsign.ssllabs.com/
Tip

Using this GlogalSign, you can check which en­cryp­tion protocols the server of a specific website has enabled.

Go to Main Menu