The historical name includes Secure Sockets Layer (SSL), but SSL is obsolete; deployments should use supported TLS versions and current cryptographic configurations.
Some SSL/TLS VPNs provide browser or reverse-proxy access to defined web applications. Others use client software to tunnel traffic for non-web applications or broader network access. The gateway terminates TLS, authenticates the user or device, applies access policy, and forwards authorized traffic toward internal or cloud resources.
Key points
Access scopeEstablish whether the service exposes individual applications, selected network routes, or a general tunnel, and enforce only the access required for the subject’s role.
Protocol securityDisable obsolete SSL and TLS versions, validate certificates and hostnames, use current algorithms, protect session tokens, and maintain a reliable update process.
Gateway and client riskHarden the internet-facing service, monitor authentication and session events, secure downloaded components, and manage browser, extension, or client-software dependencies.
Important limitationTLS protects the client-to-gateway leg, not necessarily traffic beyond the gateway. It does not establish endpoint health, application authorization, or user intent, and a stolen authenticated session may bypass the original sign-in controls.