SSL stands for Secure Sockets Layer, the protocol that encrypts the connection between a browser and a website - the thing that puts the padlock next to the address and the S in HTTPS. Here is the part the acronym hides: actual SSL is obsolete. Every version of SSL has been broken and deprecated for years. What your browser and servers actually run today is TLS, Transport Layer Security, SSL’s successor. The industry just kept saying ‘SSL’ out of habit, so the word now means TLS in every practical sentence.
The acronym is simple. The useful knowledge is why the word survived its own protocol, and what it means when a certificate, a library, or an error still says ‘SSL’.
Table of contents
- What it does, in one paragraph
- SSL is dead; TLS is what runs
- Why the word will not die
- What this means for your site
- How this fits the rest of the stack
- FAQ
What it does, in one paragraph
SSL/TLS does two things: it encrypts the connection so nobody between you and the server can read the traffic, and it authenticates the server so you know you are talking to the real site and not an impostor. The authentication comes from a certificate issued by a trusted authority; the encryption comes from a key exchange that happens in the opening handshake. Together they turn HTTP (readable by anyone on the path) into HTTPS (readable only by the two endpoints).
SSL is dead; TLS is what runs
- SSL 2.0 and 3.0 - both broken (POODLE finished off SSL 3.0 in 2014) and prohibited. No modern system should accept them.
- TLS 1.0 and 1.1 - deprecated in 2020 by every major browser. Avoid.
- TLS 1.2 - the widely-supported workhorse, still perfectly secure when configured well.
- TLS 1.3 - the modern default: faster handshake, fewer footguns, the version you want.
So when a tutorial says ‘install an SSL certificate’ or a library is called OpenSSL or PyOpenSSL, that is naming inertia. The certificate is a TLS certificate; the connection is a TLS connection. There is no separate ‘SSL certificate’ you could buy that would speak the dead protocol - and you would not want one.
Why the word will not die
‘SSL certificate’ is what people search for, what certificate vendors marketed for two decades, and what half the config directives are still named. Changing the vocabulary would confuse more people than it clarifies, so the industry quietly redefined ‘SSL’ to mean ‘the TLS encryption that secures a site’. It is one of those cases where the correct term lost and everyone agreed to keep using the wrong one because it is understood.
Practically: treat ‘SSL’, ‘SSL/TLS’, and ‘TLS’ as the same thing in conversation. Only care about the distinction when you are configuring which protocol versions a server accepts - and there, you want TLS 1.2 and 1.3 only, with real SSL disabled.
What this means for your site
Every site should be HTTPS, full stop. Browsers mark plain HTTP as ‘Not secure’, search ranks HTTPS higher, and features like HTTP/2 require it. Getting a certificate is free and automatic now - Let’s Encrypt and most hosting platforms issue and renew them without you touching a key.
# See which TLS version and cert a site is serving
openssl s_client -connect example.com:443 -tls1_3 </dev/null 2>/dev/null | grep -E "Protocol|Cipher"If you are running your own server, the goal is simple: a valid certificate, TLS 1.2 and 1.3 enabled, everything older switched off, and automatic renewal so the cert never silently expires. On a managed platform, all of that is handled for you, which is the honest argument for not running your own TLS termination unless you have a reason to.
How this fits the rest of the stack
SSL meaning TLS is a small vocabulary quirk with a real lesson under it: the padlock is table stakes, and the interesting work is making sure it is configured right and never expires. Expired or misconfigured certificates cause more outages than almost any other ‘small’ thing. The RunxBuild hosting calculator shows a site and its bandwidth as line items, and the RunxBuild dashboard issues and renews certificates automatically so HTTPS is not one more thing to remember.
Useful related references:
- Free SSL certificate: how to get one
- SSL protocol error: what it means
- Which port SSL and HTTPS use
- Static sites and headers on RunxBuild
FAQ
What does SSL mean?
SSL stands for Secure Sockets Layer, the protocol that encrypts and authenticates the connection between a browser and a website - the technology behind HTTPS and the padlock icon. In practice the word now refers to TLS, its modern successor, because actual SSL has been deprecated for years. When people say SSL certificate, they mean a TLS certificate.
Is SSL the same as TLS?
Functionally, in everyday use, yes - people say SSL but mean TLS. Technically they are different protocols: TLS is the newer, secure successor to SSL, which is obsolete and prohibited. The only time the distinction matters is when configuring which protocol versions a server accepts, where you want TLS 1.2 and 1.3 and every SSL version disabled.
Is SSL still used today?
No, not the actual SSL protocol. SSL 2.0 and 3.0 are broken and disabled everywhere, and modern connections use TLS 1.2 or 1.3. The name SSL survives in marketing (SSL certificate) and software names (OpenSSL) out of habit, but the encryption securing sites today is TLS. There is no reason to enable real SSL on any server.
What is the difference between HTTP and HTTPS?
HTTP sends data in the clear, so anyone on the network path can read or alter it. HTTPS wraps the same HTTP traffic in TLS encryption and authenticates the server with a certificate, so only the two endpoints can read it. Browsers now flag plain HTTP as Not secure, and every public site should serve HTTPS.
Do I need to pay for an SSL certificate?
No. Let’s Encrypt issues free, automatically renewing certificates, and most hosting platforms provision and renew them for you at no cost. Paid certificates mainly add organization-validation branding or specific warranty terms that most sites do not need. A free automatically-renewed certificate provides the same encryption strength as a paid one.