HTTPS / TLS

HTTPS (HTTP Secure) is the encrypted version of HTTP, secured by TLS (Transport Layer Security). It encrypts all data between a browser and a web server, preventing eavesdropping, tampering, and forgery.

Category: Security (also: Infrastructure, Web Development)

Author: Atomic Glue Security Team

## Definition

HTTPS (Hypertext Transfer Protocol Secure) is HTTP layered over TLS (Transport Layer Security). TLS is a cryptographic protocol that provides privacy and data integrity between two communicating applications. When you visit an HTTPS site, your browser and the server negotiate a TLS handshake to establish an encrypted tunnel before any HTTP data is exchanged. This protects against man-in-the-middle attacks, session hijacking, and content injection. HTTPS is now the baseline expectation for any website handling user data, and major browsers mark HTTP-only sites as Not Secure.

## How TLS Works

TLS operates in two phases. First, the **handshake** phase: the client and server authenticate each other using digital certificates (typically the server presents an SSL/TLS certificate issued by a trusted Certificate Authority), agree on a cipher suite, and generate session keys using asymmetric (public-key) cryptography. Second, the **record** phase: all subsequent communication is encrypted using symmetric keys derived during the handshake. TLS 1.2 is still widely used, but TLS 1.3 (standardized in 2018) reduces handshake latency to one round trip and removes obsolete, insecure options.

## HTTPS vs HTTP

HTTP sends data in plaintext. Anyone on the same network, at the ISP level, or on the server side can read or modify the traffic. HTTPS encrypts everything except the destination IP and port (and the Server Name Indication domain in TLS 1.3). Even the URL path, query parameters, and request bodies are encrypted. This makes HTTPS non-negotiable for login pages, payment forms, APIs, and any page that handles personal data.

## SEO and Browser Impact

Google uses HTTPS as a ranking signal. Chrome marks HTTP pages as Not Secure in the address bar. Many browser features (service workers, geolocation, clipboard API) are restricted to secure contexts (HTTPS or localhost). Let's Encrypt makes free TLS certificates available via automated ACME protocol, removing the cost barrier that once existed.

## Note

TLS is the successor to SSL. SSL 2.0 and 3.0 are deprecated and insecure. When people say SSL certificate, they almost always mean a TLS certificate. The term SSL persists but is technically incorrect.

## Common questions

Q: Is HTTPS completely secure?

A: HTTPS encrypts data in transit, but it does not protect against server-side vulnerabilities, malware on the client device, or attacks that compromise the TLS certificate authority ecosystem. It is one layer of a defense-in-depth strategy, not a silver bullet.

Q: Do I need HTTPS for a simple landing page?

A: Yes. HTTPS prevents content injection (e.g., by ISPs or attackers on public WiFi), protects link integrity, and is required for many modern browser APIs. There is no good reason to serve any site over plain HTTP in 2024.

Q: What is the difference between TLS 1.2 and TLS 1.3?

A: TLS 1.3 reduces the handshake from two round trips to one, improves performance significantly, and removes legacy algorithms like RSA key exchange and CBC mode ciphers. It is the recommended minimum for new deployments.

## Key takeaways

• HTTPS = HTTP encrypted with TLS. It is the minimum security baseline for all websites.
• TLS 1.3 is the current standard. Disable SSLv3, TLS 1.0, and TLS 1.1.
• Let's Encrypt provides free, automated TLS certificates.
• HTTPS protects data in transit only. Server-side security is a separate concern.

## Related entries

• [SSL Certificate](atomicglue.co/glossary/ssl-certificate)
• [HSTS](atomicglue.co/glossary/hsts)
• [Security Headers](atomicglue.co/glossary/security-headers)

Last updated December 2024. Permalink: atomicglue.co/glossary/https-tls