What is Secure Sockets Layer (SSL)?
SSL was created by Netscape in the mid-1990s to make it safe to send a credit card number over the early web. It did two jobs that are still done today: it encrypted the traffic between browser and server, and it used certificates issued by trusted authorities to prove that the server was who it claimed to be. Netscape's browser showed a padlock when SSL was active, and the padlock became the symbol of a secure site.
Every version of SSL is now obsolete. Serious flaws were found in each; the last, SSL 3.0, was formally retired in 2015, and modern browsers and servers refuse to use it. Its successor, Transport Layer Security, has done the job since 1999. The old name stuck, though. Hosts sell SSL certificates, dashboards have SSL settings, and people say a site has SSL when they mean it is served over HTTPS using TLS.
Why it matters
Why SSL matters
Mostly as vocabulary, and as a warning. The vocabulary matters because anyone buying hosting or certificates will meet the term everywhere, and it helps to know that an SSL certificate is the same thing as a TLS certificate: the file that proves a site's identity and enables encryption. The warning matters because a server still configured to accept old protocols is vulnerable. Security scanners and the payment card industry's rules flag any site that still allows SSL or the early versions of TLS, and the fix is a configuration change, not a new certificate. Knowing the difference saves money and, occasionally, an awkward conversation with an auditor.
In practice
How SSL works in practice
- 01
Today, getting SSL for a site means getting a certificate and serving the site over HTTPS using TLS. Most hosts issue free certificates automatically through Let's Encrypt or a similar authority, install them and renew them before they expire. Paid certificates are still sold, with organization or extended validation checks, but browsers no longer show the difference to visitors, so the free kind gives the same protection for most sites.
- 02
The checks we run are simple. The certificate covers every address the site uses, including the versions with and without www and any subdomains. It renews automatically, and someone is alerted if it does not. The server accepts only TLS 1.2 and 1.3, with SSL and early TLS switched off. And every page loads every asset over HTTPS, so no mixed content warning undermines the padlock.
Watch out
What people get wrong about SSL
Thinking SSL is still in use. Sites today run TLS; SSL survives only as a name, and a server that genuinely supports it is a security problem. Second, paying extra for a certificate in the belief that it encrypts better. Encryption strength comes from the protocol and the server settings, not from the price of the certificate. Third, treating the padlock as proof of honesty. It proves the connection is private and the domain matches; phishing sites have certificates too. And letting a certificate lapse because the renewal notices went to someone who left the company years ago.
