TLS certificate
The proper name for what most people call an SSL certificate. SSL was deprecated in 2015; today's connections use TLS, but the 'SSL' name stuck.
A TLS certificate is the same thing as an SSL certificate. The protocol name changed from SSL to TLS in 1999, then SSL was formally deprecated in 2015 (RFC 7568). But the term "SSL certificate" was already industry slang, and it stuck.
What you're actually using
When you connect to https://anything today, you're using TLS, not SSL:
| Version | Released | Status |
|---|---|---|
| SSL 2.0 | 1995 | Broken, deprecated 2011 |
| SSL 3.0 | 1996 | Broken (POODLE), deprecated 2015 |
| TLS 1.0 | 1999 | Deprecated 2021 |
| TLS 1.1 | 2006 | Deprecated 2021 |
| TLS 1.2 | 2008 | Widely deployed |
| TLS 1.3 | 2018 | Modern default |
If a server is serving HTTPS today, it's using TLS 1.2 or 1.3. SSL hasn't been in active use anywhere reputable in 10+ years.
Why anyone still says "SSL"
Marketing inertia. Domain registrars and hosting providers selling certs call them "SSL certificates" because that's what customers search for. Cloudflare's marketing page is called "SSL for SaaS" even though the underlying protocol is TLS. We do the same thing.
What changes with TLS 1.3
For SaaS operators it's mostly free wins:
- Faster handshake (one round trip vs two).
- Stronger cipher suites only.
- Encrypted SNI in some configurations.
- Better performance over mobile.
Make sure your edge supports TLS 1.3 (most do by default in 2026). If you're using something old that's only TLS 1.2, upgrade.