What HTTPS adds on top of HTTP

HTTP is text in the clear. Everything you type into a form, every session cookie and every API token travels as readable bytes, and any device on the path can not only read them but change them without either side noticing. HTTPS is the same HTTP, carried inside TLS. The interesting part is not the encryption — it is that both ends can agree on a secret key while an attacker hears every single message of the negotiation.

The handshake is that negotiation, and it happens before any request. The client opens a TCP connection, then sends a ClientHello containing a random number, the list of cipher suites it supports and a public key share. The server answers with its own random, its chosen suite and its key share. Both sides then derive the same session keys from their own private value and the other side public value, and nobody listening to the conversation can repeat that computation. At the end both send a Finished message that is a hash of everything said so far, so any modification during the handshake breaks the check immediately.

A certificate is a signed statement that binds a public key to a hostname. It contains the name, the public key, a validity window and a signature made by a certificate authority. That signature is what makes the key trustworthy — not the key itself, which proves nothing on its own. If you accept any key that is offered, an attacker simply offers their own.

Chain
  1  leaf        CN=example.org
                 SAN: example.org, www.example.org
                 valid 2026-01-01 .. 2026-04-01
  2  intern     CN=R3 Intermediate CA
  3  root        CN=ISRG Root X1  (already on the device)

Validation
  signature of 1  checked with public key of 2    ok
  signature of 2  checked with public key of 3    ok
  signature of 3  checked with public key on device  ok
  name in SAN matches the host that was requested   ok
  current time inside the validity window           okA certificate chain and the five checks a client performs.

The chain is what makes a small number of roots enough for the whole web. A root authority signs an intermediate, the intermediate signs the certificate you receive, and your device only has to already trust the root — root certificates ship with the operating system and the browser. Validation walks the chain upwards: check the leaf signature with the intermediate key, check the intermediate with the root, check that the root is one you trust, then check that the name in the certificate matches the host you actually asked for and that today falls inside the validity window. Any single failure stops the connection.

An attacker on the path who cannot produce a valid certificate has a real problem. They can drop or delay your packets, they can impersonate an address, but they cannot read the encrypted bytes and they cannot forge the handshake without a certificate your client accepts. Changing one encrypted byte does not flip a bit in the plaintext — it fails authentication and the connection ends. This is why clicking through a certificate warning is a bad idea: either the warning is a genuine misconfiguration, or you have just handed your session to the person who caused it.

$ curl -v https://example.org
*  SSL certificate problem: self-signed certificate in certificate chain
*  Closing connection

$ curl -vk https://example.org
*  Server certificate: CN=mitm-proxy.local
*  subjectAltName does not match example.org
<  HTTP/1.1 200 OKThe same request with and without certificate checking.

Forward secrecy answers a specific question: what happens to traffic that was recorded years ago, if the server private key leaks today? In the classic key exchange the session key was encrypted with the server public key, so a recorded handshake plus the leaked private key is enough to decrypt everything. With ephemeral Diffie-Hellman the key share is generated fresh for this one connection and thrown away afterwards, so a later key leak is useless against past traffic. It does not make an active attacker weaker, and it does not help if the attacker already holds the session key. It changes the value of a stolen key from all history to one session.