What is TLS, and how is it different from SSL?
Quick Answer
TLS (Transport Layer Security) is the protocol that secures data sent over a network, providing encryption, integrity checks, and identity verification. SSL (Secure Sockets Layer) was its predecessor. SSL is now obsolete and insecure — it was fully replaced by TLS years ago. People still say "SSL certificate" out of habit, but the actual protocol in use today is TLS.
Detailed Answer
TLS and SSL solve the same problem: securing data sent between two systems over a network. TLS is simply the modern, renamed continuation of SSL.
SSL 2.0 -> SSL 3.0 -> TLS 1.0 -> TLS 1.1 -> TLS 1.2 -> TLS 1.3
(all SSL versions and TLS 1.0/1.1 are now considered insecure and disabled by modern browsers)
SSL was renamed to TLS in 1999, when the protocol moved under the standards body IETF. Since then, every new version has been released as "TLS," not "SSL."
Why the SSL name still shows up everywhere:
- The term "SSL certificate" stuck around as a common phrase, even though the certificate is really used for TLS connections today.
- Tools and settings, like
ssl_certificatein nginx config files, kept their old SSL-era naming for backward compatibility.
In practice, no modern browser or server actually uses real SSL anymore — it is disabled everywhere because of known security flaws. When someone says "SSL" today, they almost always mean TLS.