They're closely related, but they refer to different layers of the same idea:
- SSL is an older security protocol (now obsolete).
- TLS is the modern replacement for SSL.
- HTTPS is HTTP running over TLS.
A simple analogy:
- HTTP = a postcard anyone handling it can read.
- TLS = a locked, tamper-evident envelope.
- HTTPS = sending your HTTP postcard inside that locked envelope.
- SSL = an older version of the envelope that is no longer considered secure.
SSL (Secure Sockets Layer)
SSL was developed in the 1990s to encrypt internet traffic.
Its goals were to:
- Encrypt data so others can't read it.
- Verify you're talking to the intended server.
- Detect if data is modified in transit.
Over time, researchers found security weaknesses in SSL, especially SSL 2.0 and SSL 3.0. These versions are now considered insecure and should not be used.
TLS (Transport Layer Security)
TLS is the successor to SSL.
It does the same job—protecting data in transit—but with stronger security and better performance.
Current status:
- TLS 1.2 is still widely supported.
- TLS 1.3 is the current recommended version for most systems.
- SSL is effectively retired, although people often still say "SSL" out of habit.
For example:
- "SSL certificate" usually actually means a TLS certificate.
- "SSL encryption" usually refers to TLS encryption.
HTTPS (Hypertext Transfer Protocol Secure)
HTTPS isn't a separate encryption protocol.
It's simply:
HTTPS = HTTP + TLS
When you visit:
https://example.com
your browser:
- Connects to the server.
- Performs a TLS handshake.
- Verifies the server's certificate.
- Creates shared encryption keys.
- Sends all HTTP requests through the encrypted TLS connection.
Without HTTPS, anyone on the network (such as someone on the same public Wi-Fi) could potentially read or modify your HTTP traffic.
How they work together
Your browser
│
│ HTTP request
▼
TLS encrypts it
▼
Encrypted data travels across the Internet
▼
Server decrypts it
▼
HTTP request is processed
What the certificate does
A website uses a digital certificate to prove its identity.
Your browser checks:
- Is the certificate signed by a trusted certificate authority?
- Is it valid and unexpired?
- Does it match the website's domain name?
If those checks pass, the browser proceeds with the secure connection. The certificate itself doesn't encrypt the data—it helps your browser authenticate the server and securely establish the encryption keys used by TLS.
Why browsers still mention SSL
You'll often hear terms like:
- "Install an SSL certificate"
- "SSL/TLS"
- "SSL handshake"
These are mostly historical names. In practice, modern browsers and servers use TLS, not SSL.
Quick summary
| Term | What it is | Still used? |
|---|
| SSL | Older encryption protocol | ❌ No (obsolete) |
| TLS | Modern encryption protocol | ✅ Yes |
| HTTP | Regular web protocol | ✅ Yes, but not encrypted |
| HTTPS | HTTP protected by TLS | ✅ Yes |
The easiest way to remember it is:
- SSL = the old version (obsolete).
- TLS = the technology that encrypts connections today.
- HTTPS = the secure version of HTTP because it uses TLS underneath.
