I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and TLSv1, SSL is not recommended. I have no problem with adding this to the guide, or linking to the relevant RFCs, but I'm a little unsure about the language the RFCs use.
- RFC 6176 prohibits the use of SSLv2, which I interpret as "Do not use this. Just...don't."
- RFC 7658 deprecates SSLv3; my interpretation of this is "Don't use this, unless you really need to."
Both RFCs state that their version of SSL must not be used. So, are my interpretations of this accurate? If not, what's the difference?