A quick timeline
- SSL 2.0 and 3.0 (1995, 1996) — Netscape's original protocol for encrypting traffic between a browser and a server. Both versions have known, serious vulnerabilities and are considered completely broken today.
- TLS 1.0 (1999) — effectively "SSL 3.1," released once the protocol moved under IETF standardization. Close enough to SSL 3.0 that the two are sometimes confused, but with meaningful security fixes.
- TLS 1.1 / 1.2 (2006, 2008) — incremental hardening. TLS 1.2 became the long-standing baseline for most of the web for over a decade.
- TLS 1.3 (2018) — a substantial redesign: faster handshakes, and it removes support for the older, weaker cryptographic algorithms that TLS 1.2 still permitted.
Every version of SSL, and TLS 1.0/1.1 along with it, has since been formally deprecated. Major browsers stopped supporting them years ago. If a server only offers SSL or old-style TLS today, modern browsers will refuse the connection outright rather than warn and proceed.
So why does everyone still say "SSL"?
Mostly inertia. "SSL certificate," "SSL checker," and the padlock icon's association with "SSL" all predate TLS's dominance, and the terminology never fully updated even as the underlying protocol did. Certificate authorities still sell "SSL certificates" — the certificates themselves are protocol-agnostic; what actually matters is which TLS versions the server hosting them is configured to accept.
This is why "SSL" and "TLS" are used almost interchangeably in casual conversation, tool names, and marketing copy, but a security audit or a browser's connection-security panel will always describe the actual protocol version in TLS terms.
What this means for your certificate
The certificate itself — the file that proves your domain's identity and carries the public key — doesn't change between SSL and TLS. What changes is the handshake protocol used to negotiate the encrypted connection before that certificate gets used. A server can hold a perfectly valid, unexpired certificate and still be misconfigured to offer only deprecated TLS versions, which is a separate problem from certificate expiry and needs its own check.
In practice, two things need to be true for a site to be considered properly secured today: the certificate must be valid and not expired, and the server must be configured to only offer TLS 1.2 and 1.3 — not SSL, and not TLS 1.0/1.1.