HTTPS is ordinary web traffic (HTTP) sent inside an encrypted connection made with TLS. It does two jobs: it keeps what you send and receive private, and it proves you are talking to the real site rather than an impostor.
The padlock means
- Encrypted: nobody between you and the site, such as public Wi-Fi or an internet provider, can read or change the traffic.
- Authenticated: the site showed a certificate, for this exact domain, signed by a certificate authority your browser trusts.
It does not mean the site is honest or safe. Scam sites can have valid certificates too.
What a certificate is
A small file that says “this public key belongs to example.com“, signed by a certificate authority (CA) such as Let’s Encrypt. Browsers and operating systems ship with a list of trusted CAs. If the signature checks out, the domain matches and the date is valid, the browser trusts the connection. If any of those fail, you see a “not private” warning.
The handshake, simply
- Your browser connects and lists the encryption methods it supports.
- The server picks one and sends its certificate.
- The browser checks the certificate.
- Both sides use key exchange to agree on fresh session keys that never travel over the network.
- Everything after that is encrypted with those keys.
With modern TLS 1.3 this takes a single round trip, so HTTPS adds very little delay.
Why every site should use it
- Browsers mark plain HTTP pages as “Not secure”.
- Many modern browser features only work over HTTPS.
- Certificates are free. See Let’s Encrypt.
SSL or TLS?
SSL is the old name. Every version of SSL is long retired, and today’s connections use TLS 1.2 or 1.3. People still say “SSL certificate” out of habit; it means the same thing.
Something out of date? Software changes. If a step no longer works, tell us and we will check it and update the page.
