What is SSL/TLS? How HTTPS secures your data
A plain-English guide · all security terms → · updated August 2026
SSL/TLS (Secure Sockets Layer / Transport Layer Security) is a protocol that encrypts data between a client and a server — so it stays private, tamper-proof and readable only by the intended recipient. It is what turns HTTP into HTTPS and puts the padlock in your browser. Think of plain HTTP as a postcard anyone on the path can read, and HTTPS as a sealed envelope only the receiver can open.
How SSL/TLS works (the handshake)
- Client connects — your browser opens an HTTPS connection to the website (port 443).
- Server presents its certificate — containing its public key.
- Certificate verification — the browser checks it against a trusted Certificate Authority (CA).
- Secure connection established — both sides agree session keys.
- Encrypted data transfer — traffic flows encrypted between browser and server.
Plain text in → unreadable ciphertext across the wire → decrypted only by the intended receiver. Anyone in between sees gibberish.
SSL vs TLS versions — which are safe?
SSL is the original protocol; TLS is its modern successor. People still say "SSL", but everything current is TLS — and the old versions are end-of-life and unsafe.
| Version | Released | Status | Use it? |
|---|---|---|---|
| SSL 2.0 | 1995 | Broken | Never — disable |
| SSL 3.0 | 1996 | Broken | Never — broken by POODLE |
| TLS 1.0 | 1999 | Deprecated | No — dropped by browsers in 2020 |
| TLS 1.1 | 2006 | Deprecated | No — deprecated, disable it |
| TLS 1.2 | 2008 | Secure | Yes — the secure minimum |
| TLS 1.3 | 2018 | Secure | Yes — current best practice |
Why this is a vulnerability-management topic
Having HTTPS "on" is only step one. Most real-world TLS failures are CVEs in the implementation — the library doing the encryption — not the protocol itself:
| Flaw | CVE | What it did | Root cause |
|---|---|---|---|
| Heartbleed | CVE-2014-0160 | OpenSSL leaked server memory — private keys, passwords, session data | Implementation bug (OpenSSL) |
| POODLE | CVE-2014-3566 | Forced a downgrade to broken SSL 3.0 to decrypt traffic | Protocol (SSL 3.0) |
| BEAST | CVE-2011-3389 | Recovered plaintext from TLS 1.0 CBC ciphers | Protocol (TLS 1.0) |
| OpenSSL padding oracle | CVE-2016-2107 | Allowed MITM attackers to decrypt traffic | Implementation bug (OpenSSL) |
The pattern is clear: enabling TLS is easy; keeping the library that implements it patched and supported is what actually keeps the channel secure. OpenSSL — the most widely deployed TLS library — is exactly the kind of component to watch.
How to check your TLS is configured securely
- Disable SSL 2.0/3.0 and TLS 1.0/1.1 entirely.
- Require TLS 1.2 as a minimum; prefer TLS 1.3.
- Use strong cipher suites with forward secrecy (ECDHE + AES-GCM / ChaCha20); drop RC4, 3DES and CBC legacy suites.
- Use a valid certificate from a trusted CA, and automate renewal so it never lapses.
- Patch the TLS library (e.g. OpenSSL) and keep it off end-of-life versions — this is where most exploited TLS bugs live.
Check your own software
- OpenSSL — check your version against known CVEs in one click.
- Check a version — paste a product + version (e.g. OpenSSL, nginx, Apache) for an instant verdict.
- Actively exploited CVEs — the 431 KEV flaws affecting tracked software right now.
Frequently asked questions
What is SSL/TLS?
SSL/TLS (Secure Sockets Layer / Transport Layer Security) is a protocol that encrypts data between a client (such as your browser) and a server, so it stays private and tamper-proof in transit. It is what puts the "S" in HTTPS and the padlock in your browser.
What is the difference between SSL and TLS?
They are the same idea, different generations. SSL is the original, now-obsolete protocol; TLS is its modern successor. All SSL versions, and TLS 1.0/1.1, are deprecated and insecure — current systems should use TLS 1.2 or TLS 1.3. People still say "SSL" out of habit, but in practice everything today is TLS.
Is TLS 1.0 or 1.1 still safe to use?
No. TLS 1.0 and 1.1 are deprecated and considered insecure; major browsers removed support in 2020 and standards like PCI DSS require them to be disabled. Use TLS 1.2 as a minimum and TLS 1.3 where possible.
What is the difference between TLS 1.2 and TLS 1.3?
TLS 1.3 is faster and more secure: it removes obsolete and weak cryptography, enforces forward secrecy, and completes the handshake in fewer round trips (so connections start quicker). TLS 1.2 is still considered secure when configured with strong cipher suites, but 1.3 is the preferred default.
Does HTTPS mean a website is safe?
No — it means the connection is encrypted and the certificate is valid, not that the site itself is trustworthy. HTTPS protects data in transit from interception and tampering; it does not vouch for the content, and attackers can obtain valid certificates too. Treat the padlock as "private channel", not "safe site".
What is a Certificate Authority (CA)?
A Certificate Authority is a trusted organisation that issues and digitally signs SSL/TLS certificates, vouching that a public key belongs to a particular domain. Your browser ships with a list of trusted CAs; if a site’s certificate chains back to one of them and is valid, the browser trusts the connection.
What is a cipher suite?
A cipher suite is the agreed set of algorithms a TLS connection uses — for key exchange, authentication, bulk encryption and integrity. Modern, secure suites use forward secrecy (ECDHE) and strong ciphers (AES-GCM, ChaCha20); old suites (RC4, 3DES, CBC-mode in older protocols) should be disabled.
What port does HTTPS/TLS use?
HTTPS uses TCP port 443, versus port 80 for plain HTTP. TLS itself also secures other protocols on their own ports (e.g. SMTPS, IMAPS, LDAPS).
Does TLS protect data at rest?
No. TLS only protects data in transit — while it moves between client and server. Data stored on disk needs separate protection (e.g. disk or database encryption). TLS and at-rest encryption solve different problems; you typically need both.
What vulnerabilities have affected SSL/TLS, and how do I avoid them?
Notable flaws include Heartbleed (OpenSSL CVE-2014-0160), POODLE (SSL 3.0), BEAST (TLS 1.0) and various OpenSSL padding-oracle bugs. Many were flaws in the TLS implementation (e.g. OpenSSL) rather than the protocol — which is why keeping your TLS library patched and off end-of-life versions matters as much as enabling TLS in the first place.
IsItPatched is an independent service and is not affiliated with the IETF, OpenSSL or any Certificate Authority. CVE data is sourced from the NVD; always verify against your vendor's official advisories and test your own configuration — see our disclaimer. 638 products tracked.