What is the difference between SSL and TLS?
Short answer
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are the same protocol family that encrypts the connection between the client and the server and verifies the server's identity with a certificate; TLS is the continuation of SSL. The last version of SSL, SSL 3.0, has been deprecated after being found insecure; the versions in use today are TLS 1.2 and TLS 1.3. The name "SSL" lives on out of habit: in TR7, certificates are kept on the SSL/TLS Certificates screen and protocol settings on the TLS Security Profiles screen, and the accepted version range is selected from SSLv3–TLSv1.3 in the Min. SSL Version / Max. SSL Version fields.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → TLS Security Profiles | Min. SSL Version, Max. SSL Version (SSLv3, TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3) | The accepted protocol version range |
| HTTP and L7 TCP vService → Details | SSL Security | Assigning the profile to the vService |
| Backend Service | Backend SSL Security Profile | The version range TR7 uses when connecting to the Backend Service with TLS |
| Certificates & PKI → SSL/TLS Certificates | Certificate records | The X.509 certificates presented in the connection |
| Load Balancer → Conditions (Policy Match) | SSL Version | A decision based on the version the client connected with |
Common Misconceptions
- "An SSL certificate and a TLS certificate are different." Both are the same X.509 certificate; which protocol version the connection is established with is determined not by the certificate but by the server's version setting.
- "Since it is in the option list, SSLv3 is secure." SSL 3.0 has been deprecated by RFC 7568, and TLS 1.0 and 1.1 by RFC 8996; the options exist only for old clients.
- "SSL and TLS are managed with separate settings." In TR7, the SSL and TLS versions are in the same Min. SSL Version / Max. SSL Version list; the labels that contain "SSL" (SSL Security, SSL/TLS Certificates) also cover TLS.
How it is done in the documentation
