If HTTPS is the armored envelope, TLS is the engine that seals it. The "S" in HTTPS is TLS. This post explains what it is, why there are versions, and why you keep hearing "SSL certificate" when the thing is actually TLS.
First, the name confusion
Everyone says "SSL certificate." The technology is actually TLS. SSL is the dead ancestor — TLS replaced it years ago. The old name just stuck, like calling every vacuum a "Hoover."
SSL = the retired grandparent. TLS = what actually runs today.
Why are there versions?
Each version exists because the previous one got broken (hackers found a way in) or was too slow. It's an evolution driven by security and speed.
| Version | Year | Status | Why it changed |
|---|---|---|---|
| SSL 2.0 / 3.0 | 1995–96 | ☠️ Dead | Fundamentally broken. Never use. |
| TLS 1.0 | 1999 | ☠️ Retired | Old crypto, attackable |
| TLS 1.1 | 2006 | ☠️ Retired | Weak, retired in 2020 |
| TLS 1.2 | 2008 | ✅ Still widely used | Solid workhorse for a decade |
| TLS 1.3 | 2018 | ✅ Current best | Faster + removed all the weak options |
TLS 1.2 vs 1.3 (the two that still matter)
| TLS 1.2 | TLS 1.3 | |
|---|---|---|
| Connect speed | 2 round trips | 1 round trip (faster) |
| Repeat visits | Full re-handshake | Near-instant reconnect |
| Weak options | Allowed if misconfigured | Removed entirely |
| Overall | Safe but has old baggage | Faster and safer |
Simple rule: aim for 1.3, allow 1.2, block everything older.
What TLS does (3 jobs)
| Job | Meaning | Analogy |
|---|---|---|
| Encryption | Scrambles data so eavesdroppers see gibberish | A locked box |
| Authentication | Proves the server is genuinely who it claims | Checking a passport |
| Integrity | Confirms data wasn't altered mid-flight | A tamper-evident seal |
The certificate = a passport for the website
TLS proves identity using a certificate, issued by a trusted authority.
- It's like a passport for a website — a trusted third party vouches that "yes, this really is swiggy.com."
- Your browser checks it automatically on every secure connection.
- Certificates expire and must be renewed — forget to, and the site breaks. (This is why HTTPS setup involves "provisioning a cert" and waiting for it.)
The handshake (in plain words)
Before any real data flows, your browser and the server do a quick handshake:
1. "Hi, here's how I can encrypt." (browser)
2. "Here's my certificate — verify me." (server)
3. Both agree on a secret key.
4. 🔒 Tunnel open. Real data now flows, encrypted.
TLS 1.3 made this handshake shorter, which is why modern secure sites connect so fast.
The whole thing in one line
TLS = the engine under HTTPS. It opens a private tunnel (encryption), checks the site's passport (authentication), and seals it against tampering (integrity). Use 1.3, keep 1.2, drop the rest.
Top comments (0)