HTTPS and TLS

SSL vs TLS: what is the difference?

SSL is the old, insecure predecessor of TLS, but the name stuck. Which versions are safe today, what an SSL certificate really is, and how to check your server.

TLS, Transport Layer Security, is the protocol that encrypts HTTPS connections. SSL was its predecessor and every version of SSL is now insecure and disabled. People still say SSL out of habit, especially in SSL certificate, but the certificates and connections in use today are TLS. Servers should support TLS 1.2 and 1.3 only.

Published 9 November 2026 · Last updated 9 November 2026

By Michal Měřínský. Audit methodology.

The short history

SSL 2.0 and 3.0, from Netscape in the 1990s. Both are broken and formally prohibited. SSL 3.0 was deprecated in 2015 after the POODLE attack.
TLS 1.0 in 1999 and TLS 1.1 in 2006. Both were formally deprecated in 2021, and modern browsers refuse them.
TLS 1.2 in 2008. Still widely used and secure with modern cipher suites.
TLS 1.3 in 2018. Faster handshakes, fewer options to get wrong, and the default in current browsers.

Why people still say SSL

The name stuck in products and habits: SSL certificate, SSL settings, SSL mode in a CDN dashboard. In nearly every case today, these mean TLS. A certificate is not SSL or TLS itself. It is used by whichever protocol version the client and server agree on.

What your server should support

TLS 1.3 and TLS 1.2 enabled.
TLS 1.1, TLS 1.0 and all SSL versions disabled.
For TLS 1.2, modern AEAD cipher suites such as AES-GCM and ChaCha20-Poly1305. Remove RC4, 3DES, export-grade and NULL suites.
A valid certificate with the full chain. Managed hosts and CDNs such as Vercel, Netlify and Cloudflare handle this for you. Self-managed servers need it checked.

How to check

Check which protocol a server negotiates:

openssl s_client -connect example.com:443 -tls1_3 </dev/null 2>/dev/null | grep -E "Protocol|Cipher"

Online tests such as SSL Labs also report every protocol and cipher a server accepts and grade the configuration.

Disabling old versions can break very old clients, such as outdated embedded devices or ancient Android versions. For a public website in 2026, that trade is almost always right.

Does this matter for SEO?

Indirectly. Browsers refuse connections with old protocols, so a server that only offers TLS 1.0 is unreachable for real visitors and crawlers alike. HTTPS itself is a lightweight Google ranking signal, and a broken TLS setup is the fastest way to lose both visitors and indexing.

What a scan can and cannot tell you

WebAuditOS records the TLS version your server negotiates with a modern client, attempts supported deprecated-cipher probes, with RC4 and 3DES explicitly untested because its runtime cannot offer them, and checks that the certificate is valid and trusted.

Because its client offers only TLS 1.2 and 1.3, a server that also still accepts TLS 1.0 or 1.1 alongside modern versions can pass the protocol check. A dedicated TLS scanner tests every legacy version individually.

A pass records the modern connection negotiated by the scanner. It does not prove old protocols are switched off.

Short answers

Is SSL still used? No. Only the name survives.

Is TLS 1.2 still secure? Yes, with modern cipher suites. TLS 1.3 is preferred.

Do I need a TLS certificate or an SSL certificate? They are the same product. Any current certificate works with TLS.

Should I disable TLS 1.0 and 1.1? Yes. Browsers already refuse them.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

sec.tls.protocol - Modern TLS protocol version
sec.tls.cipher-strength - Negotiated cipher suite is strong
sec.tls.cert-valid - TLS certificate is valid and trusted
sec.https.enabled - Site is served over HTTPS

Run a free audit See a full sample report See the whole check library