SSL vs TLS: What the Difference Actually Means
Someone asks whether your site runs SSL or TLS, and the honest answer starts with a correction. SSL is gone. Every version of it has been retired as broken, and your browser has not spoken it in years.
What you are actually running is TLS, still wearing the old name on the box. That sounds like pedantry until a payment provider or an insurer asks which versions your server accepts, at which point the distinction becomes a concrete question with a concrete answer.
Short answer: SSL and TLS are the same idea at different ages. SSL was the original protocol for encrypting web traffic, and all of its versions are now considered broken and disabled. TLS replaced it and is what browsers negotiate today. The industry kept saying SSL out of habit, so an SSL certificate is really a TLS certificate.
What is the actual difference between SSL and TLS?
Lineage, mostly. TLS 1.0 was effectively SSL 3.1 with a new name after the protocol moved to an open standards body. Later TLS versions changed the handshake, dropped weak ciphers and cut round trips. They are not two competing technologies. They are one technology with a rename partway through.
The practical differences arrive in the later versions rather than at the rename. TLS 1.2 removed a pile of ageing cipher suites and made the hashing configurable. TLS 1.3 went further, deleting nearly every option that had ever been attacked and shortening the handshake, which means fewer chances to negotiate something weak and slightly faster connections into the bargain.
Why does everyone still call it SSL?
Because the name was attached to the thing people buy. Certificate authorities built their catalogues around SSL, hosting control panels shipped SSL menus, and every support article written in the past twenty years used the word. Changing the label would have confused customers more than leaving it alone, so the industry left it alone.
You will see the hybrid “SSL/TLS” in cPanel and similar tools, which is a reasonable compromise. Nobody in a support ticket will misunderstand you for saying SSL. If you want the certificate side of this explained separately, the guide on what an SSL certificate is and what it proves covers the file itself rather than the protocol.
Which versions are still safe to use?
TLS 1.2 and TLS 1.3 are the current answer. Everything older is either formally deprecated or actively unsafe, and the major browsers removed support for TLS 1.0 and 1.1 some time ago. If a server still offers them, it is not helping anyone; it is just leaving an old door propped open for a downgrade attempt.
| Version | Status | What to do |
|---|---|---|
| SSL 2.0 | Broken, removed from everything | Nothing, it is long gone |
| SSL 3.0 | Broken by the POODLE attack | Confirm it is disabled if you run your own server |
| TLS 1.0 | Deprecated, dropped by major browsers | Disable it unless a legacy system genuinely needs it |
| TLS 1.1 | Deprecated, dropped alongside 1.0 | Disable it |
| TLS 1.2 | Current and widely required | Keep it enabled for compatibility |
| TLS 1.3 | Current, faster handshake | Enable it where the server supports it |
Card payment rules have required TLS 1.2 as a minimum for some years, which is why so many businesses discovered this topic through a compliance form rather than a security review.
Does the TLS version affect speed or search rankings?
Speed, a little. TLS 1.3 completes its handshake in fewer round trips than 1.2, which shaves latency off the first connection, and the effect is largest for visitors a long way from the server. Search rankings respond to HTTPS being present, not to which version negotiated it.
So this is not a ranking lever, and anyone selling it as one is stretching. The genuine wins are compatibility and audit results: a server that offers only current versions passes scans cleanly, and a server that still answers on TLS 1.0 fails them for a reason that takes minutes to fix.
How do I check what my site is using?
Run a public SSL test against your domain. Those tools report every protocol version the server will accept, the cipher list, the certificate chain and the expiry date, in one page. You need nothing installed and no server access. Browser developer tools will also show the negotiated version per connection under the security tab.
Two things to look for. First, whether TLS 1.0 or 1.1 still appear as accepted. Second, whether the certificate chain is complete, because an incomplete chain works in desktop browsers and fails on some phones, which produces the maddening “it works on my machine” sort of fault.
- Protocol versions accepted, with anything below TLS 1.2 flagged for removal.
- Certificate expiry date and whether automatic renewal is running.
- Chain completeness, including the intermediate certificate.
- Whether HTTP requests redirect to HTTPS rather than serving both.
What should you actually change?
On shared or managed hosting, usually nothing. Protocol versions are set at the server level by the host, not per account, so your job is to confirm the result rather than configure it. Send the scan report to support and ask them to confirm the old versions are off.
What is yours to handle sits one layer up: making sure the certificate covers both the bare domain and the www version, redirecting HTTP to HTTPS, and clearing mixed content so pages do not load images over plain HTTP. Those items appear in the security checklist for Australian businesses, and the wider security and backups section covers what to do when something has already gone wrong. If a renewal invoice prompted this reading, the piece on whether you need to buy a certificate at all is the one to read next.
GoodHost cPanel plans include a free SSL certificate with automatic renewal, and the security page lists the rest of what runs by default on an account.
Frequently asked questions
If it is really TLS, is “SSL certificate” the wrong term?
It is imprecise rather than wrong, and it is now standard everywhere. Certificate authorities sell SSL certificates, control panels have SSL menus, and the file itself is protocol agnostic anyway. The same certificate works with any TLS version your server supports. Say SSL if that is what your host says; nothing breaks because of the vocabulary.
Will disabling TLS 1.0 break access for older customers?
For a small number of very old devices, yes. Windows XP era browsers and some ancient Android handsets never learned TLS 1.2. In practice that population is now tiny, and payment processors have required TLS 1.2 for years, so most sites have already made the jump without hearing about it. Check your analytics for old browser versions before deciding.
Do I need a new certificate to support TLS 1.3?
No. The certificate proves who you are; the protocol version is negotiated separately between the browser and the server. Your existing certificate keeps working. Enabling TLS 1.3 is a server configuration change, which on shared or managed hosting is something your host handles rather than something you set per site.
Is TLS the same thing as HTTPS?
Not quite. TLS is the encryption layer. HTTPS is ordinary HTTP running inside a TLS tunnel. The same TLS layer also secures mail protocols and other traffic, which is why you see references to TLS in email client settings. HTTPS is one application of TLS, and the most visible one.
Can I check my server’s TLS versions without technical help?
Yes. Free public SSL testing tools will scan a domain and report every protocol version and cipher the server accepts, along with the certificate chain and its expiry. It takes a minute or two and needs nothing installed. If the report flags an old protocol on shared hosting, send it to your host rather than trying to fix it yourself.
Worth running a public SSL scan on your own domain this week, before a compliance form or a payment gateway runs one for you. If it flags an old protocol version and you are on shared hosting, that is a server side change rather than a site change, and the GoodHost security page explains what is managed for you and what stays in your hands.