Secure Sockets Layer (SSL) is the protocol Netscape developed to protect client/server connections over the Internet against eavesdropping, tampering, and message forgery. It is fully discontinued: every version is prohibited, and TLS has replaced it.
SSL 3.0, released in 1996, was the last version. TLS 1.0 replaced it in 1999, and RFC 2246 says TLS was “based on the SSL 3.0 Protocol Specification as published by Netscape.” The IETF has since prohibited both: RFC 6176 (2011) for SSL 2.0, and RFC 7568 (2015) for SSL 3.0, which states that “SSLv3 MUST NOT be used” and that negotiating it “from any version of TLS MUST NOT be permitted.” RFC 7568 cites the 2014 POODLE attack, in which the CBC construction of SSLv3 “trivially permits the recovery of plaintext.”
The name outlived the protocol. “SSL certificate” and the OpenSSL library still use it, but a modern connection described as SSL is TLS. See TLS (Transport Layer Security) for the current protocol and which versions to accept.
Sources
- RFC 6101: The Secure Sockets Layer (SSL) Protocol Version 3.0, IETF, August 2011 (historical record of the November 1996 specification). Retrieved October 16, 2026.
- RFC 2246: The TLS Protocol Version 1.0, section 3, IETF, January 1999. Retrieved October 16, 2026.
- RFC 6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0, IETF, March 2011. Retrieved October 16, 2026.
- RFC 7568: Deprecating Secure Sockets Layer Version 3.0, sections 1, 3, and 4, IETF, June 2015. Retrieved October 16, 2026.
See also
Go deeper
Articles
- Migrate Away from SSL/Early TLS for PCI Compliance June 30, 2018
- How To Protect Against the POODLE SSLv3 Vulnerability October 16, 2014