Runbooks still say "renew the SSL certificate" when the browser warning is obsolete protocol. The certificate can be brand new. The tunnel is still TLS 1.0.

This is a shortened English note. The tables, handshake diagram, and OpenSSL CLI checks live on the original post:

https://sunshout.tistory.com/2206

SSL vs TLS (the only distinction that matters)

SSL is a Netscape protocol from the 1990s. SSL 3.0 is withdrawn (POODLE and friends). What every browser speaks now is TLS, currently 1.2 or 1.3.