What's the difference between SSL and TLS?

TLS is the modern protocol; SSL is the old name (and old protocol) that TLS replaced. SSL 2.0 was deprecated in 2011, SSL 3.0 in 2015 (POODLE attack made it unsafe). Everything in production today is TLS 1.2 or TLS 1.3. The term 'SSL certificate' persists in marketing copy and dashboards out of habit, but the protocol you're actually using is TLS.

Are paid certificates more secure than free ones?

No. Cryptographically, a Let's Encrypt DV certificate provides the same encryption strength as a $500 OV or EV certificate. The difference is in the validation level: DV proves you control the domain; OV/EV adds organisation verification (which browsers no longer surface prominently in the address bar). For most sites, free DV certificates are the right choice.

How long do TLS certificates last in 2026?

Public-CA-issued certificates have a maximum 398-day validity (CA/Browser Forum baseline requirement, dropping to 90 days during 2026–2027). Most ACME-issued (Let's Encrypt, ZeroSSL) are 90-day certificates renewed automatically. Internal / private CA certificates can have longer validity but should follow the same renewal hygiene.

What's a wildcard certificate?

A wildcard certificate covers any single-level subdomain — `*.example.com` covers `www.example.com`, `api.example.com`, etc. It does not cover the apex (`example.com` itself — list that separately) or multi-level subdomains (`a.b.example.com`). Wildcard certificates require DNS-01 ACME validation, not HTTP-01.

Should I deploy CAA records alongside my certificates?

Yes. CAA records constrain which CAs may issue certificates for your domain. Without CAA, any compromised CA could issue. With CAA listing only your CAs (e.g., Let's Encrypt + your enterprise CA), other CAs are obligated to refuse issuance. Combine with Certificate Transparency log monitoring for full coverage.

Email & TLSBeginner

SSL and TLS Certificates Explained

Understand what SSL and TLS certificates are, how they protect your website, and why every site should use them.

Updated 10 June 2026

Start free Browse guides

Answer snapshot

TLS certificates authenticate a server to its clients and encrypt the connection between them. 'SSL' is the old name (deprecated since 1999); 'TLS' is the modern protocol. Public CAs issue certificates after verifying you control the domain (DV) or the organisation (OV/EV). Let's Encrypt and other ACME-based CAs make DV certificates free and automatable. DNS records like CAA constrain which CAs may issue for your domain; TLSA / DANE binds certificates to your domain via DNSSEC.

What you'll learn

Understand what SSL/TLS certificates are and how they work
Learn the difference between SSL and TLS
Know the types of certificates (DV, OV, EV)
Understand certificate chains and trust hierarchies

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are protocols that secure communication between your website and its visitors. They ensure that sensitive data, like passwords or payment information, remains private and protected.

How SSL and TLS Work

When a visitor accesses your website via HTTPS, SSL or TLS encrypts the connection. This prevents hackers from intercepting or tampering with data as it travels between the browser and your server.

Websites with valid certificates display a padlock icon in the browser, showing users that the connection is safe.

Before encrypted traffic begins, the browser and server perform a TLS handshake. During that setup, the client sends a ClientHello, the server presents its certificate chain, both sides agree on cryptographic parameters, and fresh session keys are derived. After the handshake succeeds, HTTP requests and responses travel inside the encrypted TLS channel.

The certificate is only one part of the handshake. It authenticates the server, while the key exchange creates the encryption keys that protect the session. DNS records can support this process: CAA records control which CAs may issue certificates, TLSA records can publish DANE certificate associations, and HTTPS records can advertise connection metadata such as HTTP/3 and Encrypted Client Hello.

Why Certificates Are Important

Protect user data from interception
Improve trust and credibility
Boost search engine ranking
Enable secure transactions

Conclusion

SSL and TLS are essential for maintaining a secure and trustworthy website. By combining DNS reliability from dnscale.eu with SSL encryption, you can deliver both performance and protection to your users.

What Is an SSL Handshake? - how TLS setup works before encrypted traffic begins
What Is an SSL Certificate Chain - root, intermediate, and leaf certificate validation
DNS CAA Record Explained - control certificate issuance through DNS
DNS TLSA Record Explained - DANE certificate binding with DNSSEC
Let's Encrypt DNS-01 Challenges - automate certificate issuance with DNS

Frequently asked questions

What's the difference between SSL and TLS?: TLS is the modern protocol; SSL is the old name (and old protocol) that TLS replaced. SSL 2.0 was deprecated in 2011, SSL 3.0 in 2015 (POODLE attack made it unsafe). Everything in production today is TLS 1.2 or TLS 1.3. The term 'SSL certificate' persists in marketing copy and dashboards out of habit, but the protocol you're actually using is TLS.
Are paid certificates more secure than free ones?: No. Cryptographically, a Let's Encrypt DV certificate provides the same encryption strength as a $500 OV or EV certificate. The difference is in the validation level: DV proves you control the domain; OV/EV adds organisation verification (which browsers no longer surface prominently in the address bar). For most sites, free DV certificates are the right choice.
How long do TLS certificates last in 2026?: Public-CA-issued certificates have a maximum 398-day validity (CA/Browser Forum baseline requirement, dropping to 90 days during 2026–2027). Most ACME-issued (Let's Encrypt, ZeroSSL) are 90-day certificates renewed automatically. Internal / private CA certificates can have longer validity but should follow the same renewal hygiene.
What's a wildcard certificate?: A wildcard certificate covers any single-level subdomain — `*.example.com` covers `www.example.com`, `api.example.com`, etc. It does not cover the apex (`example.com` itself — list that separately) or multi-level subdomains (`a.b.example.com`). Wildcard certificates require DNS-01 ACME validation, not HTTP-01.
Should I deploy CAA records alongside my certificates?: Yes. CAA records constrain which CAs may issue certificates for your domain. Without CAA, any compromised CA could issue. With CAA listing only your CAs (e.g., Let's Encrypt + your enterprise CA), other CAs are obligated to refuse issuance. Combine with Certificate Transparency log monitoring for full coverage.

Related guides

Ready to manage your DNS with confidence?

DNScale provides anycast DNS hosting with a global network, real-time analytics, and an easy-to-use API.

Start free