What is Secure Sockets Layer (SSL)?
SSL 2.0 and SSL 3.0 are obsolete and must not be used. Modern systems use TLS. TLS can provide confidentiality, integrity, and server authentication when it is configured correctly and the peer validates the certificate and expected name. Client certificates can add client authentication. Do not use the term SSL/TLS to imply that SSL remains an acceptable protocol.
Why it matters
Old SSL protocols have known design defects. Clear TLS terminology helps teams reject obsolete configurations and verify certificate, name, and protocol settings.
How it works
- The peers negotiate a supported TLS version and cryptographic parameters.
- The client validates the server certificate and expected service name, and the server can also validate a client certificate.
- The handshake derives traffic keys that protect later records for confidentiality and integrity.
Example
A browser uses TLS to reach Pomerium, and Pomerium uses a separate verified TLS connection to the protected upstream service.
Pomerium boundary
Pomerium supports TLS from users to Pomerium and from Pomerium to upstream services. It can also require downstream client certificates or present a client certificate to an upstream service for mutual TLS.
Limits and non-claims
- TLS protects a connection, but it does not decide whether a user can perform an application action.
- An endpoint compromise can expose data before encryption or after decryption.
- Weak trust settings, skipped name checks, expired certificates, or obsolete protocol versions can defeat expected protection.
Evaluation checklist
- Does every endpoint reject SSL and negotiate an approved TLS version and algorithm set?
- Does the client validate the certificate path and intended service name?
- Where does TLS terminate, where does plaintext exist, and can another path bypass protection?
