SSL 1.0 through TLS 1.3, click any entry to expand it. For the complete story behind any single event, our SSL History category has a full article on each.
The first publicly deployed version, released by Netscape. Shipped with serious weaknesses — no protection against certain downgrade and truncation attacks — that shaped how the entire protocol family evolved afterward.
Read the full story →A full redesign of SSL 2.0. Remained in active use for nearly two decades until the POODLE attack, disclosed in October 2014, made continued use unsafe.
Read the full story →Published as RFC 2246, marking the protocol's move from Netscape's proprietary stewardship to the IETF open standards process — the point "SSL" formally became "TLS," even though the old name never fully went away in everyday use.
Read the full story →Addressed specific weaknesses in how TLS 1.0 handled CBC-mode encryption — a fix that only partially closed the door on the vulnerability class that later became the BEAST attack.
Read the full story →Introduced substantially more flexibility — a broader range of supported cryptographic algorithms, removing some hardcoded choices earlier versions had baked in. Became the dominant version for over a decade and remains widely supported today.
Read the full story →A practical padding-oracle attack against SSL 3.0 gave attackers a real way to decrypt portions of supposedly secure traffic — the beginning of the end for SSL 3.0 specifically.
Read the full story →Finalized as the direct, cumulative response to roughly a decade of named vulnerabilities against TLS 1.2 and earlier. Removed legacy algorithms entirely, mandated forward secrecy, and cut the handshake to a single round trip.
Read the full story →
Loading comments…