HTTPS, SSL/TLS and certificates

The padlock in your browser

• When you see HTTPS and a padlock, your connection to the website is encrypted.
• The "S" stands for Secure. It uses a protocol called TLS (the modern version of SSL).

How the secure connection is set up

• TLS cleverly combines both kinds of encryption you have learned:
• It uses asymmetric encryption to safely agree on a shared secret key.
• Then it switches to fast symmetric encryption for the rest of the conversation.
• This "handshake" happens in a fraction of a second, before any page loads.

How do you know the site is real?

• Encryption is useless if you are talking to an impostor. That is what digital certificates solve.
• A website's certificate is issued by a trusted Certificate Authority (CA) and signed with the CA's key.
• Your browser checks the signature. If it is valid, you know the site is who it claims to be.

Putting it together

• Certificate → proves who the site is. TLS → keeps the conversation secret.
• That tiny padlock means: encrypted, and verified. No padlock on a login page? Walk away.

Covers: IGCSE 5.3 (SSL), A-Level 17.1 (SSL/TLS, digital certificates).

Now you try

• First put the four handshake steps in the right order — the exam loves this sequence.
• Then be the browser: look at a certificate's details and decide whether to trust it.

Common mistakes

• HTTPS encrypts the traffic; the certificate proves the site's identity.
• A certificate warning is a real warning — do not click through it.