What Is HTTPS and TLS? The Padlock Explained

TL;DR

• HTTPS is the normal web protocol (HTTP) running inside an encrypted TLS connection, so others on the network cannot read or change what passes between you and the site [1][2].
• A certificate lets the site prove that a trusted authority linked its domain name to its keys.
• The padlock means the connection is protected. It does not mean the website itself is honest or safe.
• Before data flows, your browser and the server run a short handshake to agree on settings and a secret key.

What HTTPS and TLS are #

HTTP is the language browsers and websites use to exchange pages. On its own it is sent as plain text, with the browser sending a request and the server answering [5], so anyone who can see the network, such as someone on public Wi-Fi, could read it. HTTPS is an encrypted version of HTTP that uses TLS to protect all communication between client and server [1].

TLS (Transport Layer Security) is the successor to the older SSL, and the two names are often used loosely for the same idea. MDN lists three things TLS gives you [2]:

• Encryption. Data in transit cannot be read by eavesdroppers.
• Integrity. Data cannot be changed on the way without being noticed.
• Authentication. The server can prove who it is. On the web the server normally proves its identity to you, while you usually do not prove yours.

The current version is TLS 1.3, defined in RFC 8446. Versions 1.0 and 1.1 should no longer be used [2][3].

Certificates and the padlock #

How does your browser know it reached the real example.com and not an impostor? Through a digital certificate. It holds a signed copy of the site's public key and ties it to the domain name [2].

The signing is done by a certificate authority (CA). Before issuing a certificate, a CA makes the requester prove it controls the domain, for example by placing a particular file or DNS record [4]. Browsers come with a list of CAs they trust, and they will warn you if a certificate is expired, does not match the site name, or is not signed by a trusted authority.

When the checks pass, the browser shows a padlock or similar sign. Be careful what you read into it. The certificate says the connection goes to the domain you typed, and that it is encrypted. It says nothing about whether the owner of that domain is trustworthy, so scam sites can use HTTPS too. Check the address itself before entering a password.

The TLS handshake #

Before any page is sent, the two sides run a handshake. In simple terms [2][3]:

1. Hello. Your browser says which TLS versions and encryption methods (cipher suites) it supports and shares material for creating a key.
2. Server's answer. The server chooses the settings from that list and sends its own key material. Everything after this is encrypted.
3. Proof. The server sends its certificate and a proof that it holds the matching private key.
4. Finished. Both sides confirm the handshake was not tampered with, and then exchange application data.

The result is a secret key that only the two ends know. It is then used to encrypt the actual web traffic, because that style of encryption is fast. The handshake uses public-key methods only to set the key up safely.

What HTTPS does not do #

• It does not hide which site you are visiting from the network, in all cases, only the content of the traffic.
• It does not protect a device that already has malware.
• It does not guarantee the site is legitimate.

FAQ #

Is HTTPS the same as SSL? #

Not exactly. SSL is the older protocol and TLS replaced it. People still say "SSL certificate" out of habit, but modern HTTPS uses TLS [2].

Does the padlock mean a website is safe? #

No. It means your connection to that site is encrypted and the certificate matched the domain. A fraudulent site can have both, so still check the address and be careful with what you enter.

Why does my browser say "Not secure"? #

Usually the page is sent over plain HTTP, or the certificate has a problem such as being expired. Avoid entering passwords or card details on such a page.

Where do certificates come from? #

From certificate authorities. Some, like Let's Encrypt, issue them for free and automatically after checking domain control [4].

Sources #