How HTTPS and TLS Keep You Safe

Every login form, cookie and API call travels across networks you do not control: coffee-shop Wi-Fi, ISPs, backbone routers. HTTPS is the mechanism that keeps that traffic private and untampered. This lesson explains what TLS actually does, how certificates create trust, and how to configure HTTPS correctly on your own sites.

What Problem Does HTTPS Solve?

Plain HTTP sends everything in readable text. Anyone on the network path can read it (breaking confidentiality), alter it (breaking integrity), or impersonate the server entirely. HTTPS is simply HTTP running inside a TLS (Transport Layer Security) tunnel, which provides three guarantees:

Encryption: eavesdroppers see only ciphertext.
Integrity: any modification in transit is detected and the connection fails.
Authentication: the certificate proves you are talking to the real domain, not an imposter.

The TLS Handshake, Simply

When your browser connects to a site, the two sides perform a handshake:

The client says hello, listing the TLS versions and cipher suites it supports.
The server responds with its chosen cipher and its certificate.
The client verifies the certificate chain against trusted certificate authorities built into the OS or browser.
Using asymmetric cryptography, both sides agree on a fresh shared session key.
All further traffic is encrypted symmetrically with that session key, which is fast.

Modern TLS 1.3 shortens this exchange and removes obsolete, weakened options entirely. If your servers still allow TLS 1.0 or 1.1, disable them.

Certificates and the Chain of Trust

A certificate binds a public key to a domain name, signed by a Certificate Authority (CA). Browsers trust a small set of root CAs; those roots sign intermediates, which sign your site's certificate, forming a chain. Free automated CAs such as Let's Encrypt issue certificates validated by proving control of the domain, and tools like Certbot renew them automatically. There is no longer any cost excuse for HTTP.

Certificates expire deliberately, limiting how long a stolen key is useful. Automate renewal and monitor expiry, because an expired certificate takes your site down with a scary browser warning.

Configuring HTTPS Correctly

Getting a certificate is step one; serving it well is step two. A solid setup redirects all HTTP to HTTPS and tells browsers to never try HTTP again using HSTS:

nginx

# Nginx: enforce HTTPS with modern TLS
server {
  listen 80;
  server_name example.com;
  return 301 https://example.com$request_uri;  # redirect all HTTP
}
server {
  listen 443 ssl http2;
  server_name example.com;
  ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_protocols TLSv1.2 TLSv1.3;   # no legacy protocols
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

The Strict-Transport-Security header (HSTS) instructs browsers to use HTTPS for your domain for a year, defeating downgrade tricks where an attacker forces a first request over plain HTTP.

Common Mistakes to Avoid

Mixed content: loading scripts or images over http:// inside an HTTPS page weakens or breaks the protection; browsers now block much of it.
Terminating TLS and forgetting the inside: traffic between a load balancer and app servers still deserves encryption in zero-trust environments.
Ignoring cookie flags: mark session cookies Secure so they are never sent over plain HTTP, plus HttpOnly to keep scripts away from them.
Skipping certificate validation in code: never disable TLS verification in HTTP clients, even in testing, because that habit leaks into production.

What HTTPS Does Not Do

HTTPS secures the pipe, not the endpoints. A phishing site can have a perfectly valid certificate for its lookalike domain; the padlock means 'connection is private', not 'site is honest'. It also does nothing about vulnerabilities in your application code, which the next lessons address.

Key Takeaways

HTTPS is HTTP inside TLS, providing encryption, integrity and server authentication.
Certificates and the CA chain of trust let browsers verify who they are talking to.
Use TLS 1.2+, redirect HTTP, enable HSTS, and mark cookies Secure and HttpOnly.
Automate certificate issuance and renewal with Let's Encrypt.
HTTPS protects data in transit only; application security is still on you.

Next lesson: Encryption Basics: Symmetric vs Asymmetric, where we open the cryptographic toolbox TLS is built from.