Glossary · ENCheck a domain

TLS and SSL

Transport Layer Security (TLS) is a set of communication rules that creates a protected connection between two applications, such as a browser and a website. It helps prevent someone on the network from reading or changing data in transit and can verify the server's identity. The older Secure Sockets Layer (SSL) protocols are obsolete and should not be used, although people still say “SSL” informally when they mean modern TLS.

How does TLS protect a connection?

The browser and server first perform a handshake: they agree on security settings, establish shared digital keys used to protect the data, and, in common web use, the browser checks the server's certificate and domain identity. After the handshake, TLS uses the keys to protect application data sent across the connection. For HTTPS, this protection applies to HTTP requests and responses.

For example, when Morgan visits https://example.com, the browser negotiates TLS with the server, checks that the server's certificate matches example.com, and then sends the HTTP request through the protected channel. Someone observing the network should not be able to read the page contents in transit or alter them without detection. The connection does not stop the website from seeing the request after it decrypts it.

Is SSL the same as TLS?

SSL came before TLS. SSL version 3.0 was formally retired because it is not sufficiently secure, and the IETF has also retired older TLS versions. Current systems should negotiate supported modern TLS versions; they should not use SSL merely because a product setting or certificate is casually called “SSL.”

The phrase “SSL certificate” is also commonly used for a TLS certificate. A certificate is not itself an encryption protocol: it carries identity information and public keys that TLS can use to check the server's identity. TLS then establishes the protected channel.

Related terms