SurveyMonkey Engineering Blog

Ideas you will meet

Distributed Systems

Consensus, time, failure and the fundamentals of scale-out.

What we already know about this

Our own lessons on these ideas. Read them here before you start, so it makes sense.

• Core Concepts: How Things Actually Work · 8 minHow HTTPS worksCertificates, key exchange and encryption in plain language: what the padlock actually proves.Read hereClose

  What it provides

  HTTPS is HTTP inside TLS. TLS gives three things:

  1. Confidentiality: outsiders cannot read the traffic.
  2. Integrity: tampering is detected.
  3. Authentication: you are talking to the real owner of the domain.

  The handshake, simplified

  100%

  Figure SDA-CORE-05-1 · The handshake, simplified · © forcsguy.com

  1. The browser says which versions and ciphers it supports.
  2. The server answers with a certificate containing its public key.
  3. The browser checks the certificate: signed by a trusted authority, matches the domain, not expired, not revoked.
  4. They run a key exchange (modern TLS uses ephemeral Diffie-Hellman) to agree on a secret that never crosses the network.
  5. From that secret both sides derive symmetric session keys and encrypt everything after.

  TLS 1.3 shortens this to one round trip, and can resume with none.

  100%

  Figure SDA-CORE-05-2 · The order of a secure page load · © forcsguy.com

  Image: Mx. Granger · CC0 · Source · Wikimedia Commons: Three padlocks

  Certificates and trust

  A certificate says "this public key belongs to example.com", signed by a certificate authority. Your browser and operating system ship with a list of trusted CAs. A server presents a chain (its certificate, plus intermediates) that leads to one of them.

  Free automated certificates (for example from Let's Encrypt) made HTTPS the default. Certificates expire, so renew automatically and monitor expiry: an expired certificate is a common cause of outages.

  A useful detail: asymmetric operations are one-way in practice. Anyone can encrypt or verify with the public key, but only the private-key holder can decrypt or sign. That asymmetry is what lets strangers agree on a secret over an open network, and why the session then switches to a much faster shared symmetric key.

  Forward secrecy

  With ephemeral key exchange, each session uses fresh keys. If the server's long-term key is stolen later, old recorded traffic still cannot be decrypted.

  What HTTPS does not do

  • It does not make a site trustworthy: phishing sites use HTTPS too.
  • It does not hide which site you visit from the network (the domain is visible in DNS and sometimes in the handshake).
  • It does not protect data once it reaches the server: you still need good storage security.

  Practical checklist

  • Redirect HTTP to HTTPS and send an HSTS header so browsers refuse plain HTTP.
  • Use TLS 1.2 or 1.3 only; disable old protocols.
  • Mark cookies Secure and HttpOnly.
  • Automate certificate renewal and alert before expiry.

  Real-world reading

  Related reading

  • Chrome Developers BlogGoogle engineers · GoogleBlogs
  • RFC 9000: QUICIETFDocumentation
  • Web VitalsGoogle web.dev · GoogleDocumentation
  • Domain-Driven Design ReferenceEric Evans · Domain LanguageBooks

  Show 6 moreShow fewer

  • Traffic Infrastructure (Edge Network) at DropboxDropbox engineers · DropboxCase Studies
  • .NET Engineering Blog.NET engineers · .NETBlogs
  • Anthropic BlogAnthropic engineers · AnthropicBlogs
  • OLX Engineering BlogOLX engineers · OLXBlogs
  • monday.com Blogmonday.com engineers · monday.comBlogs
  • SurveyMonkey Engineering BlogSurveyMonkey engineers · SurveyMonkeyBlogs

  Open this lesson with its quiz and exercise