Two Names, One Thing
SSL, Secure Sockets Layer, was the original encryption protocol for the web in the 1990s. It was replaced by TLS, Transport Layer Security, in 1999, and every version of SSL has since been found insecure and switched off. The name stuck. People say SSL, hosting companies sell SSL certificates, and what runs underneath is TLS, currently version 1.2 or 1.3.
What It Does
When a browser connects to a site over https, TLS handles the handshake: the site proves its identity with its certificate, the two agree on an encryption method, and from then on everything that passes between them is scrambled to anyone in between. A form submission, a login, a page view, all of it. Without TLS, a contact form filled in on public wifi is readable by anyone else on that wifi.
Mail uses it too. Modern mail servers encrypt the connection between them with the same protocol, so a message in transit is not readable along the way. A mail server that does not offer it is marked down by the servers it talks to.
What Can Be Wrong With It
Old versions still enabled. A server that still accepts TLS 1.0 or 1.1, or any SSL, is open to attacks those versions were retired for, and scanners flag it. A certificate that does not match the domain, or has expired, breaks the handshake entirely. A site that has TLS available but does not force it, so visitors who type the address without https get the unencrypted version.
How To Check It
The padlock in the browser confirms TLS is working for that page. A free online SSL test reports which protocol versions a server accepts and grades the setup. BizPinPro servers are set to TLS 1.2 and 1.3 only and are checked by the same monitoring that watches certificate expiry.
The Foundation Connection
TLS is the encryption named under Active Security in the Digital Foundation and the mechanism behind the SSL certificate. It is set once on the server, correctly, and checked from outside, so the business never has to think about it again.
