What is SSL/TLS? A Complete Guide for 2026
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols that provide encrypted communications over computer networks. Understanding them is essential for anyone running a website, API, or web application.
The Difference Between SSL and TLS
Technically, SSL is the older protocol. Netscape developed SSL 1.0, 2.0, and 3.0 in the 1990s. TLS is the modern replacement, with TLS 1.0 released in 1999, followed by TLS 1.1, TLS 1.2, and TLS 1.3 (the current standard, released in 2018).
Despite this, the industry still colloquially says "SSL certificate" when referring to what is technically a TLS certificate. The important thing to understand is that all modern SSL/TLS certificates use TLS under the hood — SSL 2.0 and 3.0 are deprecated and insecure.
Important — if your server still supports SSL 3.0 or TLS 1.0/1.1, you are vulnerable. These versions have known weaknesses including POODLE and BEAST attacks. Upgrade to TLS 1.2 or TLS 1.3 immediately.
How TLS Works: The Handshake
When your browser connects to a website over HTTPS, a TLS handshake occurs. Here is what happens step by step:
- Client Hello: Your browser sends supported TLS versions, cipher suites, and a random number to the server.
- Server Hello: The server responds with the chosen TLS version and cipher suite, plus its digital certificate.
- Certificate Verification: Your browser validates the server's certificate against trusted Certificate Authorities (CAs).
- Key Exchange: Both parties use asymmetric encryption to securely agree on a session key.
- Encrypted Communication: All further data is encrypted using the agreed session key (symmetric encryption).
Types of SSL/TLS Certificates
There are three main types of SSL/TLS certificates, differentiated by their level of validation:
The CA only verifies that you control the domain. Issued within minutes. Best for blogs, personal sites, and development environments.
The CA verifies both domain ownership and basic organization information. Takes 1–3 days. Best for businesses and SaaS applications.
The most rigorous validation, confirming legal identity of the organization. Takes 1–5 business days. Best for financial institutions and e-commerce.
What is a Certificate Authority (CA)?
A Certificate Authority is a trusted organization that issues digital certificates. When your browser sees a certificate signed by a trusted CA, it trusts the identity of the server. The most widely recognized CAs include DigiCert, Sectigo, GlobalSign, and Let's Encrypt (a free, open CA).
Operating systems and browsers maintain a list of trusted root CAs. If a certificate is signed by an authority not on this list — or if the chain of trust is broken — users will see a security warning.
Why SSL/TLS Certificates Expire
SSL/TLS certificates have an intentional expiry period. The industry standard has moved to a maximum of 397 days (about 13 months). Apple, Google, and Mozilla all enforce this in their root store policies. The reason for expiry is security: shorter lifetimes reduce the window of exposure if a private key is compromised.
When a certificate expires, browsers display a hard error to users — a full-page warning that blocks access. This causes immediate loss of traffic, trust, and conversions. This is why monitoring certificate expiry is not optional — it is a critical part of any website's operational health.
Key Takeaways
Use our free SSL Certificate Checker to verify any domain's certificate validity and expiry date instantly — no signup required — and the Certificate Chain Checker to see its full chain.
Common questions
What is the difference between SSL and TLS?
SSL (Secure Sockets Layer) is the predecessor to TLS (Transport Layer Security). SSL 2.0 and 3.0 are both deprecated due to serious security vulnerabilities. Modern websites use TLS 1.2 or TLS 1.3. Despite this, the term "SSL certificate" remains in common use — what people call an SSL certificate is actually a TLS certificate.
How long does an SSL certificate last?
The maximum validity period is 398 days (about 13 months). Let's Encrypt certificates are valid for 90 days and are designed to be renewed automatically. When a certificate expires, browsers show a security warning and block users from accessing the site.
What are the three types of SSL certificate validation?
Domain Validation (DV) verifies only that you control the domain — fastest to issue, used for most websites. Organization Validation (OV) additionally verifies the organization's legal identity. Extended Validation (EV) is the most rigorous, requiring extensive documentation — historically showed a green bar in browsers, though this was removed in 2019.
Do I need an SSL certificate for my website?
Yes. Without HTTPS, browsers mark your site as "Not Secure", Google ranks it lower in search results, and modern browsers may block certain features (geolocation, camera, service workers). Free certificates from Let's Encrypt make HTTPS accessible to everyone.
References and further reading
The specifications and primary documentation this article is based on.
Read next
More guides on the same subject.