What will happen if SSL gets prohibited?

Question

When browsing the internet about TLS and SSL I found that on 30th June 2018, IETF are prohibiting SSL and TLS 1.0 because of exploits such as POODLE (Found it on this website: https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls). IsIETF or another organisation/company making an alternative to SSL so all protocols that use it (not just HTTPS) will still work?

Answer 1

When browsing the internet about TLS and SSL I found that on 30th June 2018, IETF are prohibiting SSL and TLS 1.0 ....

While you don't provide a source for this claim ("browsing the internet" is not a useable source) I think you are confusing several things here:

• SSL 2.0 is broken for years, SSL 3.0 is considered broken too (POODLE attack), TLS 1.0 has known weaknesses but is not considered critically broken (POODLE does not apply here, except for buggy implementations which did not correctly implement the standard)
• The IETF is not prohibiting TLS 1.0 on 30th June 2018. Instead this date comes from the PCI security standards councel which is relevant for example for payment providers.

The document Migrating from SSL and Early TLS includes the following statement:

After June 30, 2018, all entities must have stopped use of SSL/early TLS as a security control, and use only secure versions of the protocol (an allowance for certain POS POI terminals is described in the last bullet, below)

Here "early TLS" refers to TLS 1.0 and "SSL" to SSL 3.0 which means that one can still use TLS 1.1 and TLS 1.2 and also the new TLS 1.3 wherever PCI requirements apply. And you can continue to use TLS 1.0 outside these requirements (i.e. for non-payment sites) although use of the well supported and more secure TLS 1.2 (or better) is recommended. Also, all modern OS and browsers have support for TLS 1.2 for years, thus there is no need to worry.