SSL vs TLS: the differences and which to use

SSL means Secure Sockets Layer, and TLS means Transport Layer Security and is SSL's successor. For web applications, prefer TLS 1.3 instead of SSL.

In short:

• Prefer TLS 1.3. Keep TLS 1.2 for compatibility with appropriate configuration.
• Disable old versions. Don't use SSL 2.0, SSL 3.0, or TLS 1.0 or 1.1.
• Check the connection. An “SSL certificate” label doesn't tell you which protocol was negotiated.

What changes when you use TLS

SSL and TLS serve the same broad purpose, but their versions and supported security features change what you should use.

TLS isn't simply a new name for an unchanged protocol. For example, SSL 3.0 doesn't support the extensions that let recent TLS versions add features to their connection rules.

Correctly implemented TLS protects traffic from being read or tampered with and supports checking the server's identity. An ordinary HTTPS connection doesn't imply that the client is authenticated too. Mutual TLS can authenticate clients with certificates, and applications can use separate login mechanisms. Check which authentication method the service actually requires.

Which TLS versions you should use

Default web applications to TLS 1.3. Retaining TLS 1.2 can preserve compatibility with clients that need it, without re-enabling older protocols. Disable SSL 2.0 and 3.0, and TLS 1.0 and 1.1.

TLS 1.2 still needs careful configuration. RFC 9325 requires implementations that support TLS 1.2 to follow its TLS 1.2 recommendations, even when they default to TLS 1.3. Don't treat the version number alone as proof that the settings are safe.

The RFC Editor announcement for RFC 9846 identifies it as a TLS 1.3 specification that replaces RFC 8446 and adds requirements for TLS 1.2 implementations. A new specification number doesn't mean a new TLS protocol version appeared. Treat RFC 9325's deployment advice as guidance, not a complete account of those newer requirements. If you retain TLS 1.2, check your implementation's current documentation against them.

Why certificates still say SSL

TLS sets the rules for a protected connection. A certificate helps the client check the server's identity. HTTPS, short for Hypertext Transfer Protocol Secure, uses TLS to protect web communication.

“SSL certificate” is usually a legacy name for a certificate used with TLS, not a certificate that requires the old SSL protocol. You don't need to replace an existing certificate solely because its sales label says SSL. Its validity, suitability and identity checks still matter. The certificate must match the server identity the client expects, including the hostname.

A valid certificate doesn't prove that a website is honest or its server is configured securely. TLS protects communication between its endpoints, but it doesn't hide content from an endpoint you've accepted. For example, the server receiving your request can read that request.

What to check about your connection

When you review a connection report or ask your administrator, request the negotiated protocol version and the certificate-validation result. “Negotiated” means the version the client and server agreed to use for that connection. The server's permitted-version list describes its options, not necessarily the version used. The certificate's SSL or TLS label describes neither.

Both the client and server need a shared supported version. A TLS 1.2 connection doesn't prove that the server lacks TLS 1.3, because client support or either side's settings may explain the choice. If you expected TLS 1.3, compare the client and server's supported and enabled versions. If certificate validation failed, don't treat the connection as an authenticated connection to the intended server.

Don't diagnose a connection error from the word “SSL” alone. An old-looking value in the record layer, the format that carries TLS messages, also doesn't prove an obsolete version was negotiated. RFC 8996 permits legacy record-layer values in the client's initial message while forbidding TLS 1.0 negotiation. Check the reported negotiated version instead of inferring it from that field.

Where doxx.net fits. doxx.net is a private network where people and agents share private channels, run on its own IP space, Domain Name System (DNS) root and hardware. That describes the network's role, not your application's certificate checks or negotiated TLS version. See the doxx.net download page for its supported apps and setup options.