Stop saying SSL: TLS only does three jobs, and your 'SSL cert' is usually not the outage

Runbooks still say "renew the SSL certificate" when the browser warning is obsolete protocol. The certificate can be brand new. The tunnel is still TLS 1.0.

This is a shortened English note. The tables, handshake diagram, and OpenSSL CLI checks live on the original post:

https://sunshout.tistory.com/2206

SSL vs TLS (the only distinction that matters)

SSL is a Netscape protocol from the 1990s. SSL 3.0 is withdrawn (POODLE and friends). What every browser speaks now is TLS, currently 1.2 or 1.3.

People still say "SSL cert" because vendors sold that phrase. The file is an X.509 certificate. The handshake that uses it is TLS.

If a ticket says "SSL is broken", translate it to: which TLS version did the handshake negotiate, and which cipher?

The tunnel only has three jobs

1. Confidentiality — encryption so a tap does not yield plaintext.
2. Integrity — a MAC (today: AEAD) so a MITM cannot flip bits unnoticed.
3. Authentication — the certificate binds this hostname to a key a CA will vouch for.

https is that tunnel. It is not "the lock icon means the page is safe to click." It means the bits on the wire are for that name, encrypted, and unmodified. XSS and a malicious origin are a different layer.

The outage that is not the certificate

Symptom: new Let's Encrypt leaf, browsers still scream obsolete TLS or refuse the handshake on phones.

Cause: nginx/Apache/openssl still allow TLS 1.0/1.1, or the server has no 1.2+. Renewing the cert does nothing.

Check, do not guess:

# must fail
openssl s_client -connect example.com:443 -tls1
# must work
openssl s_client -connect example.com:443 -tls1_2

nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

Keep TLS 1.2 next to 1.3 if you still have old Android or old Java. New services can prefer 1.3.

What to put in the cipher line

• Key exchange: ECDHE (forward secrecy). Static RSA key exchange is how yesterday's traffic gets decrypted after a key leak.
• Bulk: AES-GCM or ChaCha20-Poly1305. CBC + HMAC is how Lucky Thirteen-class bugs keep showing up.
• Drop: 3DES, RC4, MD5, SHA-1 as a PRF.

OpenSSL 1.0.2 / 1.1.1 are past EOL. Heartbleed was a reminder that "it still links" is not a security policy. Run 3.x LTS and patch when the project says High/Critical.

Let's Encrypt vs OpenSSL

Let's Encrypt issues the certificate. OpenSSL (or BoringSSL, or the language runtime) runs the handshake with that certificate. Buying a cert does not harden ssl_protocols.

Private key files: chmod 400 or 600, owned by the daemon user, not world-readable. Compression off (SSL_OP_NO_COMPRESSION) — CRIME/BREACH.

I keep the longer Korean original, including the four-step handshake and a cipher table, here:

https://sunshout.tistory.com/2206

If your site opens but a scanner still flags TLS 1.0, paste the openssl s_client -tls1 output before you renew anything else.