SSL or TLS: what is the difference, and which version should an IoT device use today?
SSL is the old Netscape protocol; TLS is its standardised successor. Every SSL version and TLS 1.0/1.1 are deprecated. Use TLS 1.2 or TLS 1.3. "SSL certificate" is just the everyday name for the X.509 certificate TLS uses.
| Version | Year | Status |
|---|---|---|
| SSL 2.0, SSL 3.0 | 1995, 1996 | Broken and prohibited (SSL 3.0 deprecated by RFC 7568) |
| TLS 1.0, TLS 1.1 | 1999, 2006 | Deprecated by RFC 8996 (2021) |
| TLS 1.2 | 2008 (RFC 5246) | Still fine with modern cipher suites. This is what the garage-door log shows (SSL connection using TLSv1.2) |
| TLS 1.3 | 2018 (RFC 8446) | Current: one round trip less, only forward-secret key exchanges, certificate encrypted |
The name SSL survives everywhere: "SSL certificate", the library OpenSSL, curl's SSL connection using … line. None of that means the old protocol is in use. A certificate is not tied to a protocol version at all; the same certificate works for TLS 1.2 and 1.3.
For an ESP32, both TLS 1.2 and 1.3 are available through mbedTLS in ESP-IDF. TLS 1.2 is the more widely supported default; TLS 1.3 saves a round trip on every new connection, which matters on battery.
Go deeper:
Wikipedia — Transport Layer Security — history from SSL to TLS 1.3 and the attacks that retired each old version.- RFC 8996 — Deprecating TLS 1.0 and TLS 1.1 — why the two old TLS versions must no longer be negotiated.