How HTTPS works

What it provides

HTTPS is HTTP inside TLS. TLS gives three things:

1. Confidentiality: outsiders cannot read the traffic.
2. Integrity: tampering is detected.
3. Authentication: you are talking to the real owner of the domain.

The handshake, simplified

100%

Figure SDA-CORE-05-1 · The handshake, simplified · © forcsguy.com

1. The browser says which versions and ciphers it supports.
2. The server answers with a certificate containing its public key.
3. The browser checks the certificate: signed by a trusted authority, matches the domain, not expired, not revoked.
4. They run a key exchange (modern TLS uses ephemeral Diffie-Hellman) to agree on a secret that never crosses the network.
5. From that secret both sides derive symmetric session keys and encrypt everything after.

TLS 1.3 shortens this to one round trip, and can resume with none.

100%

Figure SDA-CORE-05-2 · The order of a secure page load · © forcsguy.com

Image: Mx. Granger · CC0 · Source · Wikimedia Commons: Three padlocks

Certificates and trust

A certificate says "this public key belongs to example.com", signed by a certificate authority. Your browser and operating system ship with a list of trusted CAs. A server presents a chain (its certificate, plus intermediates) that leads to one of them.

Free automated certificates (for example from Let's Encrypt) made HTTPS the default. Certificates expire, so renew automatically and monitor expiry: an expired certificate is a common cause of outages.

A useful detail: asymmetric operations are one-way in practice. Anyone can encrypt or verify with the public key, but only the private-key holder can decrypt or sign. That asymmetry is what lets strangers agree on a secret over an open network, and why the session then switches to a much faster shared symmetric key.

Forward secrecy

With ephemeral key exchange, each session uses fresh keys. If the server's long-term key is stolen later, old recorded traffic still cannot be decrypted.

What HTTPS does not do

• It does not make a site trustworthy: phishing sites use HTTPS too.
• It does not hide which site you visit from the network (the domain is visible in DNS and sometimes in the handshake).
• It does not protect data once it reaches the server: you still need good storage security.

Practical checklist

• Redirect HTTP to HTTPS and send an HSTS header so browsers refuse plain HTTP.
• Use TLS 1.2 or 1.3 only; disable old protocols.
• Mark cookies Secure and HttpOnly.
• Automate certificate renewal and alert before expiry.

Real-world reading