What is HTTPS?

HTTPS is HTTP communication protected by TLS. It helps protect the confidentiality and integrity of data travelling between browser and server and authenticate the destination domain. It matters for sessions, forms and personal information, not only payment pages.

How do TLS and digital certificates work?

An initial handshake establishes parameters for protected communication. The server’s certificate helps verify the relationship between its domain and key. Session information is subsequently protected with negotiated keys. Browsers check validity periods, domain matching and the chain of trust. HTTPS should protect subresources such as images and scripts as well as the main document. Loading HTTP resources in a protected page can create mixed-content problems. Although SSL remains a familiar expression, current implementations rely on TLS.

What does HTTPS not guarantee?

Encryption does not establish that a website is honest or its information correct. Fraudulent sites can hold valid certificates, so the domain still needs careful attention. HTTPS alone does not protect a compromised device, fix server authorization errors or prevent users voluntarily disclosing information. It differs from private browsing and does not conceal every item of network metadata. Measures such as HSTS strengthen use of secure connections. Certificate warnings call for investigating the problem rather than simply overriding them.