SSL/TLS are the protocols that encrypt data as it travels between your device and a server, and they are what put the S in HTTPS. SSL is the original name and is now obsolete; every secure connection today actually uses TLS (Transport Layer Security), though people still say SSL out of habit. A short negotiation called the handshake authenticates the server with a certificate, agrees on the encryption, and sets up a shared key, after which all traffic is scrambled. The current versions are TLS 1.2 and TLS 1.3.
What Is SSL/TLS?
SSL/TLS is a layer of protocols that secures data in transit between two machines. The names trace a clear lineage:
- SSL (Secure Sockets Layer): the original 1990s protocol. SSL 2.0 and 3.0 are broken and disabled; SSL 3.0 fell to the POODLE attack in 2014.
- TLS (Transport Layer Security): the modern successor that replaced SSL. TLS 1.2 is widely supported and TLS 1.3 is the current best.
- Deprecated middle versions: TLS 1.0 and TLS 1.1 were retired by the IETF in 2021 (RFC 8996) and should be turned off.
- The common name lag: certificates are still sold as “SSL certificates” even though they secure TLS connections.
The identity check at the start of every TLS connection relies on a digital certificate.
How Does the TLS Handshake Work?
The handshake authenticates the server and agrees on a shared key before any real data moves.
- Client hello. Your browser proposes the TLS versions and cipher suites it supports.
- Certificate. The server sends its certificate, which the browser verifies up the chain of trust to a root it already trusts.
- Key exchange. The two sides use the server’s public key (or a fresh ephemeral key) to agree on a shared secret without sending it in the clear.
- Finished. Both sides confirm they derived the same session key.
- Encrypted data. All further traffic is protected with fast symmetric encryption. TLS 1.3 completes this in a single round trip.
If certificate verification fails at the second step, the browser shows a warning instead of completing the handshake.
How Does SSL/TLS Combine Symmetric and Asymmetric Encryption?
TLS uses asymmetric encryption to set up the connection and symmetric encryption to carry it. This hybrid design gets the best of both.
The two families are compared in depth in symmetric vs asymmetric encryption.
What Does the Padlock Icon Actually Mean?
The padlock means the connection is encrypted and the certificate is valid, not that the site is trustworthy.
- It confirms: traffic is encrypted with TLS and the certificate matches the domain and is currently valid.
- It does not confirm: the operator is honest, the content is genuine, or the site is not a scam.
- Still essential: the absence of HTTPS on a page that asks for a password or payment is a clear red flag.
Last Thoughts on SSL/TLS
SSL/TLS encrypts data in transit and authenticates the server through a certificate, and TLS has fully replaced the obsolete SSL. The handshake verifies identity and agrees on a key, then the session switches to fast symmetric encryption, with TLS 1.3 doing it in a single round trip. The padlock confirms encryption and a valid certificate, not honesty, so a current TLS version plus good judgment about the site both matter.
TLS is the protocol that carries most secure traffic on the internet. The hub on cybersecurity sets it next to the other core defenses.
Key Takeaways:
- SSL/TLS encrypts data in transit and is the S in HTTPS; TLS replaced the obsolete SSL.
- Use TLS 1.3 and TLS 1.2; TLS 1.0 and 1.1 were deprecated in 2021.
- The handshake authenticates the server with a certificate and agrees on a session key.
- TLS pairs asymmetric setup with fast symmetric encryption for the session.
- The padlock means encrypted and valid, not safe; phishing sites can have one too.
Frequently Asked Questions (FAQs)
Is SSL the same as TLS?
No. TLS is the modern successor to SSL. Every secure connection now uses TLS, but the name SSL persists in common use and in the term SSL certificate.
What does the TLS handshake do?
The TLS handshake authenticates the server, negotiates encryption parameters, and establishes a shared session key. After it completes, application data transfers under symmetric encryption.
Does the padlock icon mean a site is safe?
No. The padlock confirms the connection is encrypted and the certificate is valid. It does not confirm the operator is honest, since attackers can obtain valid certificates.
Which TLS version should a server use?
A server should support TLS 1.3 and TLS 1.2. The Internet Engineering Task Force deprecated TLS 1.0 and TLS 1.1 in 2021 through RFC 8996.
What is the difference between HTTP and HTTPS?
HTTP sends data in plaintext, while HTTPS runs HTTP over a TLS-encrypted connection. HTTPS protects the confidentiality and integrity of data between browser and server.
What encryption does TLS use?
TLS uses asymmetric encryption to exchange a key during the handshake, then symmetric encryption such as AES to protect the bulk of the session data.
