Learning objectives
By the end of this lesson you will be able to:
- Explain what problem SSL/TLS was designed to solve.
- Describe the three security properties that a certificate-based connection provides.
- Identify the difference between HTTP and HTTPS at a conceptual level.
The problem: plain text on a shared network
When a browser sends a request to a web server using plain HTTP, the data travels as readable text through every intermediate device: your home router, your internet service provider, and any network operator along the path.
Anyone with access to one of these points can read, and potentially alter, the traffic. This is not a hypothetical risk. Public Wi-Fi networks in cafes and airports are a well-documented example of networks where traffic interception is easy to perform with available tools.
Three distinct risks follow from sending data in plain text:
- Eavesdropping. A third party reads the content of the communication, for example a password or a credit card number.
- Tampering. A third party modifies the data in transit, for example injecting malicious JavaScript into a web page.
- Impersonation. A third party pretends to be the legitimate server, tricking the user into sending sensitive data to the wrong destination.
What SSL/TLS provides
SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) are cryptographic protocols designed to address exactly these three risks.
Note on terminology: SSL is the older protocol family (versions 1.0 through 3.0), all of which are now considered insecure and are disabled in modern browsers. TLS (versions 1.0 through 1.3) replaced SSL starting in 1999. In everyday language, including in this course, "SSL certificate" is used as a common shorthand for what is technically a TLS certificate, because the term SSL became entrenched in industry usage before the TLS rename took hold. You will see both terms used interchangeably in documentation, vendor sites, and job postings.
A properly configured TLS connection, signaled by HTTPS instead of HTTP in a URL, provides three guarantees:
| Property | What it means |
|---|---|
| Confidentiality | The content of the communication is encrypted, so an eavesdropper sees only unreadable ciphertext. |
| Integrity | Any modification of the data in transit is detectable, because it breaks a cryptographic check. |
| Authentication | The client can verify that it is actually talking to the server it intended to reach, not an impostor. |
A certificate is the component that makes the authentication property possible. Encryption alone does not prove identity: you can set up an encrypted channel with an attacker just as easily as with the legitimate server. The certificate is what lets the browser verify whose public key it is actually using.
A small worked example
Suppose you type https://www.examplebank.com into your browser. Without TLS, an attacker performing a man-in-the-middle attack on an open Wi-Fi network could present their own web page that looks identical, capture your login credentials, and forward you to the real site, and you would have no way to notice. With TLS, your browser checks a certificate presented by the server. That certificate is cryptographically tied to the domain name examplebank.com and signed by a trusted third party. If the attacker cannot produce a certificate that passes this check for that exact domain, the browser displays a warning instead of silently proceeding.
Common misconceptions
- "HTTPS means the site is trustworthy." HTTPS only guarantees that the connection to the domain you see in the address bar is encrypted and that you are talking to the legitimate holder of that domain's certificate. It says nothing about whether the organization behind the domain is honest. Phishing sites commonly use valid HTTPS certificates for their own fraudulent domains.
- "SSL and TLS are different things in practice today." For a beginner, treat the terms as synonyms. The protocol actually in use on virtually every modern website is TLS, usually version 1.2 or 1.3.
Recap
- Plain HTTP traffic is readable and alterable by anyone on the network path.
- TLS (commonly still called SSL) provides confidentiality, integrity, and authentication.
- A certificate is specifically the mechanism that enables authentication, that is, proving server identity.
- HTTPS indicates TLS is in use, but it does not vouch for the trustworthiness of the organization running the site.