What Is HTTPS? – Definition and How It Works
Learn what HTTPS is, what TLS provides, how certificates establish identity, and what the padlock does and does not tell a visitor.
HTTPS is HTTP carried over TLS. The requests, responses, methods, and status codes are unchanged; the connection beneath them is encrypted, integrity-checked, and authenticated.
1. What TLS Provides
- Confidentiality — the content cannot be read in transit.
- Integrity — modification is detected.
- Authentication — the server is proven to be the one requested.
The third is what makes the first two meaningful. Encryption to an unverified party protects nothing, because that party may be an interceptor.
2. Certificates Establish Identity
A certificate binds a public key to a hostname and is signed by an authority the client trusts. The client checks the hostname matches, the validity period covers now, the chain reaches a trusted root, and the certificate has not been revoked.
Domain-validated certificates — the common kind — prove control of the domain and nothing about the organisation behind it.
3. What the Padlock Means
It means the connection is private and the server proved control of that hostname.
It does not mean the site is honest, safe, or reputable. Phishing sites hold valid certificates routinely, which is why browsers have de-emphasised the padlock and now mark plain HTTP as insecure instead.
4. What Remains Visible
An observer still sees the destination address, usually the hostname, and the size and timing of exchanges. DNS lookups are also visible unless encrypted DNS is in use.
HTTPS hides what was said, not who was spoken to.
5. Why It Is Now Universal
Certificates are free and issuance is automated; handshake costs are small and resumption cheaper; browsers require a secure context for many capabilities; and HTTP/2 and HTTP/3 are effectively HTTPS-only in practice.
The historical arguments against it — cost, complexity, performance — have all been removed.
6. Mixed Content
A secure page that loads scripts, styles, or data over plain HTTP undermines its own guarantees, so browsers block or upgrade those requests.
Everything a page loads must be secure, which is why migrating a site means auditing every embedded resource rather than only the page URL.
7. For Automated Clients
Certificate verification must stay on. Disabling it removes the identity guarantee for every request thereafter, and it is a one-line change that is easy to make and easy to forget.
Where an internal authority is in use, add its root to the trust store instead. Certificate errors are also informative: expiry, hostname mismatch, and missing intermediates each name their own fix.
8. Summary
HTTPS is HTTP inside TLS, providing confidentiality, integrity, and verified server identity, with certificates binding a key to a hostname.
The padlock indicates a private connection to a verified hostname, not a trustworthy destination — and identity verification is the part that must never be disabled for convenience.