What is SSL?

Secure Sockets Layer (SSL) is the original protocol for authenticating and encrypting a connection between a client and a server, using certificate authority-issued certificates and a handshake to agree on session keys. It was formally superseded by TLS, but “SSL” still names the whole encrypted-web lineage in everyday use.

Key takeaways

• SSL encrypts client-server traffic using certificates and a handshake.
• SSL 2.0 and SSL 3.0 are both formally deprecated and insecure today.
• TLS is SSL’s IETF-standardized successor; most “SSL” traffic is now TLS.
• Versa inspects SSL/TLS via forward-proxy or full-proxy decryption profiles.
• SSL VPN lets remote users tunnel to Versa gateways without IPsec.

On this page: Why it matters · How it works · Types · SSL & Versa · FAQ

Why is SSL important?

SSL – and the TLS protocol that replaced it – is the reason a browser can be trusted at all. Before SSL, HTTP traffic and credentials traveled across networks in plain text, readable by anyone between client and server. SSL fixed that with certificate-based authentication and encryption, so a browser can confirm it is talking to the real server, and the data cannot be read or altered in transit.

That trust model became the foundation the internet runs on: every HTTPS padlock traces back to the SSL handshake design. Even though SSL itself is now broken and disabled everywhere in production, the certificate infrastructure it introduced still governs how TLS – and every product that inspects encrypted traffic, including Versa’s SD-WAN and SASE gateways – is configured today.

What is SSL?

SSL works through a handshake: before any application data moves, the client and server negotiate how the session will be protected. The server presents a certificate – issued and signed by a certificate authority – proving its identity and carrying its public key. The client validates that signature, then both sides agree on a shared session key, which is far faster for encrypting the data that follows.

The record protocol then takes over: it encrypts, integrity-checks, and frames every message using the negotiated cipher suite. If either side detects tampering or an unsupported cipher, the session drops rather than silently downgrading. Authenticate first, then encrypt in bulk – that design is what every later version of SSL and TLS still follows.

Types of SSL

Two SSL versions shipped before the protocol moved to the IETF. SSL 2.0 (1995) had serious design flaws and was formally prohibited in 2011. SSL 3.0 (1996) fixed much of that but was broken by the 2014 POODLE attack and deprecated in 2015. Neither should ever be negotiated today.

The IETF then renamed the protocol TLS: TLS 1.0 is functionally SSL 3.1, and the lineage continued through TLS 1.1, 1.2, and the current TLS 1.3. “SSL” today usually means the SSL/TLS family, not the deprecated protocol itself.

Two deployment forms matter operationally. SSL/TLS decryption terminates and re-establishes the handshake at a gateway so a firewall can inspect the plaintext. SSL VPN uses the handshake and record protocol – instead of IPsec – to build a remote-access tunnel through a browser or client.

SSL & Versa

Versa’s secure web gateway inspects SSL/TLS traffic through TLS decryption profiles, configured from the Security tab alongside firewall, antivirus, and IPS settings. Each profile chooses an SSL forward proxy – a transparent proxy that terminates and re-establishes the handshake without either endpoint being aware of it – or an SSL full proxy, running in explicit or transparent mode against specific addresses and ports. Profiles set the supported TLS version range and how to react to expired certificates, untrusted issuers, or unsupported ciphers.

Beyond inspection, Concerto SASE configuration offers SSL VPN as a remote-access option alongside IPsec: the Versa SASE client connects using a proprietary SSL VPN protocol built on TLS and DTLS. Secure LDAP authentication (LDAPS or STARTTLS) is another place SSL surfaces directly in the UI.

Frequently asked questions

What is the difference between SSL and TLS?

SSL is the original protocol Netscape introduced in the 1990s; TLS is the IETF’s renamed, hardened successor that replaced it starting with TLS 1.0 in 1999. Every “SSL” connection made today is actually TLS – the SSL name persisted in common usage after the protocol itself changed.

Is SSL still safe to use?

No. Both SSL 2.0 and SSL 3.0 have known cryptographic weaknesses – including the POODLE downgrade attack – and are formally deprecated by the IETF. Modern browsers and servers reject SSL connections outright and negotiate TLS 1.2 or TLS 1.3 instead.

What is an SSL certificate?

An SSL certificate is a digital credential, issued and signed by a certificate authority, that binds a public key to a server’s identity. During the handshake, the server presents its certificate so the client can verify it is reaching the genuine, expected server before exchanging encrypted data.

What is SSL decryption or inspection?

SSL decryption terminates an encrypted session at a security gateway, inspects the plaintext for threats or policy violations, then re-encrypts it before forwarding – using a forward or full proxy. It lets firewalls and IPS engines see inside traffic that would otherwise hide malware or data loss.

What is SSL VPN?

SSL VPN is a remote-access method that uses the SSL/TLS handshake and record protocol, rather than IPsec, to build an encrypted tunnel between a remote user and a gateway. It typically needs only a browser or a lightweight client, simplifying access for users outside the corporate network.

More on SSL

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SSL, these are worth looking at next.