The padlock in your browser is so familiar that most people never wonder what it means. Behind it lies one of the most important systems on the internet: the encryption that keeps your data private and confirms you are really talking to the site you intended. This guide explains HTTPS, the difference between SSL and TLS, and what the handshake actually does.
SSL vs TLS: the naming
People say "SSL" out of habit, but the protocol in use today is TLS. SSL was the original protocol from the 1990s; it had serious flaws and has been fully deprecated. TLS is its successor, now at version 1.3. When someone says "SSL certificate", they mean a TLS certificate. The term stuck even though the technology moved on.
What HTTPS protects
- Confidentiality — nobody between you and the server can read the data.
- Integrity — the data cannot be altered in transit without detection.
- Authenticity — you are talking to the genuine server, not an impostor.
A common myth is that HTTPS only matters for login pages. In reality it protects every page, preventing networks from injecting ads, tracking content, or tampering with anything you load.
The handshake, briefly
When you connect, the browser and server perform a TLS handshake. The server presents its certificate, which the browser checks against trusted certificate authorities. They then agree on encryption keys using public-key cryptography, and switch to fast symmetric encryption for the rest of the session. All of this happens in milliseconds before the first byte of content arrives.
Certificates and trust
A certificate ties a domain to a public key and is signed by a certificate authority your browser trusts. This chain of trust is what stops an attacker from simply claiming to be your bank. Free authorities like Let’s Encrypt have made certificates universal, which is why HTTPS is now the default expectation for every site.
The takeaway
HTTPS is no longer optional. It protects users, it is required for modern browser features, and search engines favour it. If a site you run still serves anything over plain HTTP, migrating to HTTPS is one of the highest-value changes you can make.