Is it "SSL" or "TLS" — and does the difference matter?

Is it "SSL" or "TLS" — and does the difference matter?

Why do we still say "SSL certificate" when SSL has been dead for nearly a decade? A naming question with a real security answer underneath.

SSL (Secure Sockets Layer) was Netscape's protocol from the mid-1990s. It was renamed TLS (Transport Layer Security) at version 1.0 in 1999 (RFC 2246) when the IETF took it over. So the lineage is: SSL 2.0 → SSL 3.0 → TLS 1.0 → 1.1 → 1.2 → TLS 1.3 (RFC 8446, 2018).

Every version with "SSL" in the name is now prohibited:

— SSL 2.0 formally deprecated by RFC 6176 (2011)
— SSL 3.0 broken by the POODLE attack and deprecated by RFC 7568 (2015)

The phrase "SSL certificate" survives purely as marketing inertia — there is no such thing technically; the certificate (X.509) is protocol-agnostic and works identically whether the handshake runs TLS 1.2 or 1.3.

What actually matters is the protocol version your server negotiates. TLS 1.0 and 1.1 were deprecated in 2021 (RFC 8996). Modern baseline is TLS 1.2 minimum, 1.3 preferred.

Further reading: RFC 8446 (TLS 1.3); RFC 8996 (deprecating TLS 1.0/1.1).

Bottom line: "SSL" is a legacy label for a retired protocol. The cert doesn't change; what you must check is that you negotiate TLS 1.2+.