TLS versions explained: from SSL 3.0 to TLS 1.3

TLS (Transport Layer Security) is the cryptographic protocol that secures HTTPS connections. It has been through several versions over three decades, and each one fixed real, exploitable flaws in the one before. This article walks through them — what each version changed, what broke it, and where the protocol stands today.

What TLS actually does

TLS provides a secure channel between two peers with three properties: authentication (the server proves its identity), confidentiality (nobody in the middle can read the traffic), and integrity (data cannot be modified without detection). It has two main parts: a handshake protocol that authenticates the peers and negotiates encryption parameters, and a record protocol that protects the traffic that follows.

The SSL era: 1.0, 2.0, 3.0

Netscape built the original SSL protocols in the 1990s. SSL 1.0 was never publicly released because of serious security flaws. SSL 2.0 (February 1995) was quickly found broken too: it used the same keys for authentication and encryption, its MAC construction was vulnerable to length-extension attacks, and the handshake itself was unprotected. SSL 3.0 (1996) was a complete redesign that fixed these flaws, and it became the basis of everything that followed.

SSL 3.0 stayed in use for decades — too long. In October 2014, Google researchers published the POODLE attack, which exploited SSL 3.0's CBC-mode padding: on average, 256 requests revealed one byte of encrypted data. Because browsers downgraded to SSL 3.0 when newer versions failed, the flaw was practical. In June 2015, the IETF formally declared SSL 3.0 insecure (RFC 7568).

TLS 1.0 — the SSL rename (1999)

TLS 1.0 (RFC 2246, January 1999) was an upgrade of SSL 3.0, standardized by the IETF and renamed from "SSL" to "TLS". The changes were significant enough that TLS 1.0 and SSL 3.0 could not interoperate. Its weakness: the CBC cipher modes it used were vulnerable to a chosen-plaintext attack. That was demonstrated publicly in 2011 as the BEAST attack, which could decrypt cookies from a TLS 1.0 connection. The fix arrived with the next version.

TLS 1.1 — patching CBC (2006)

TLS 1.1 (RFC 4346, April 2006) was a modest update: it replaced the implicit initialization vector with an explicit one and changed how padding errors were handled, closing the class of CBC attacks that BEAST later exploited. It never saw wide adoption on its own — most sites went from TLS 1.0 straight to TLS 1.2.

TLS 1.2 — the long workhorse (2008)

TLS 1.2 (RFC 5246, August 2008) was the version that carried the web for a decade. It replaced the MD5/SHA-1 combination with SHA-256 in its key derivation, and — most importantly — added support for authenticated encryption (AEAD) ciphers such as AES-GCM. These ciphers encrypt and authenticate in one step, eliminating the padding-oracle weaknesses of CBC. TLS 1.2 is still the practical minimum today: RFC 8996 moved TLS 1.0 and 1.1 to Historic status, so servers are expected to support at least 1.2.

TLS 1.3 — faster and safer (2018)

TLS 1.3 (RFC 8446, August 2018) was a major redesign. Key changes:

• One round trip instead of two — a full handshake completes in 1-RTT, with a 0-RTT option for resuming clients.
• Forward secrecy is mandatory — static RSA and Diffie-Hellman key exchanges were removed; every key exchange now uses ephemeral keys, so compromising a server's long-term key cannot decrypt past sessions.
• Only AEAD ciphers remain — legacy algorithms, compression, renegotiation and non-AEAD ciphers were dropped. Every implementation must support TLS_AES_128_GCM_SHA256.
• The handshake is encrypted — all messages after the ServerHello are protected, so certificates and client data are no longer sent in the clear.

The deprecation timeline

• 2015 — SSL 3.0 declared insecure (RFC 7568).
• 2016 — DROWN shows SSLv2 support can break modern TLS connections; over 81,000 of the top 1 million websites were vulnerable.
• June 2018 — PCI Council deadline to move off TLS 1.0.
• October 2018 — Apple, Google, Microsoft and Mozilla jointly announce TLS 1.0/1.1 deprecation.
• March 2020 — major browsers remove TLS 1.0 and 1.1 support.
• March 2021 — IETF formally deprecates TLS 1.0 and 1.1 (RFC 8996).

Version table

What it means today

All major browsers support TLS 1.2 and 1.3 by default, and disable 1.0 and 1.1. If you run a server, the practical rule is: support TLS 1.2 and 1.3, prefer 1.3, and disable everything older. You can check which version a site uses in your browser's developer tools — the Security panel shows the TLS version of the current connection.

FAQ

What is the difference between TLS and SSL?

SSL (Secure Sockets Layer) was the original protocol developed by Netscape in the 1990s; TLS (Transport Layer Security) is the IETF-standardized successor. TLS 1.0 (RFC 2246, 1999) was technically an upgrade of SSL 3.0 but renamed to mark the new stewardship. The name 'SSL' stuck in everyday language — many people still say 'SSL certificate' even when the protocol in use is TLS 1.2 or 1.3.

Is TLS 1.2 still safe to use in 2026?

Yes. RFC 8996 moved TLS 1.0 and 1.1 to Historic status, so the practical minimum is TLS 1.2. TLS 1.2 with AEAD ciphers such as AES-GCM is still considered secure and is what most servers negotiate as a fallback. If you control a server, prefer TLS 1.3 but keep TLS 1.2 enabled for compatibility.

Why is TLS 1.3 faster than TLS 1.2?

TLS 1.3 reduces the handshake from two round-trips to one (1-RTT), and supports 0-RTT for resumed sessions. It also encrypts all handshake messages after the ServerHello, so certificate and key material never travel in the clear. The result is a visibly faster first connection and a smaller attack surface during the handshake.

What does it mean when a server still offers TLS 1.0 or TLS 1.1?

It means the server has not been updated to follow RFC 8996 (March 2021), which deprecates both. Major browsers have removed support, so most users cannot connect anyway. If a service you depend on still negotiates these versions, treat it as a security signal and look for an alternative.

Summary

Each TLS version fixed the flaws of its predecessor: SSL 3.0 redesigned SSL 2.0, TLS 1.1 patched the CBC weaknesses of TLS 1.0, TLS 1.2 brought modern authenticated encryption, and TLS 1.3 made handshakes faster and forward secrecy mandatory. Old versions are gone for a reason — if a server still offers them, that is a sign to look elsewhere.