Step 1 What anyone on the wire can see
Your request crosses dozens of machines — your router, your ISP, backbone hops, the server's network. With plain http://, every one of them can read (and change) the bytes. https:// wraps the same request in TLS so those machines see only ciphertext.
Type a "request" and flip the protocol
Step 2 Two kinds of key
The trick that makes it all work: asymmetric keys come in pairs. A public key locks (encrypts); only the matching private key unlocks (decrypts). The server publishes its public key to the world but never shares the private one. Anyone can lock a box that only the server can open.
Lock a secret with the server's public key — who can open it?
Asymmetric maths is slow, so TLS only uses it briefly — to safely agree on a small symmetric key (one key that both locks and unlocks). The rest of the conversation uses that fast symmetric key. Step 3 shows the handover.
Step 3 The handshake, message by message
Before any page data flows, the two sides run a short scripted conversation to authenticate the server and establish that shared symmetric key. Step through it:
(browser)
1234.nu
Step 4 Certificates — why you trust that public key
A public key alone proves nothing — an attacker could send their own. So the server presents a certificate: its public key plus its domain, signed by a Certificate Authority your browser already trusts. Trust flows down a chain. Click each link:
Your operating system and browser ship with a list of trusted root CAs. The root vouches for an intermediate, the intermediate signs the site's certificate. If any signature fails — or the domain on the cert does not match the address bar — the browser refuses and you get the scary red warning.
Step 5 Slow once, fast forever after
Public-key maths is expensive; symmetric encryption is cheap. So TLS pays the asymmetric cost once during the handshake, only to agree on a shared symmetric key — then every request and response after that is encrypted with the fast symmetric cipher. Modern TLS 1.3 trims the handshake to a single round trip, and resumed connections skip almost all of it.
Relative cost per operation (illustrative)
This is why a page with hundreds of requests is not hundreds of handshakes: the connection is reused, and the heavy maths happens at most once.
Step 6 Glossary
| Term | In one sentence |
|---|---|
TLS | Transport Layer Security — the protocol that encrypts the connection; the "S" in HTTPS. |
asymmetric key | A public/private pair: public locks, only private unlocks. |
symmetric key | One shared key that both locks and unlocks — fast, used for the bulk traffic. |
handshake | The opening exchange that authenticates the server and agrees a symmetric key. |
certificate | The server's public key + domain, signed by a CA the browser trusts. |
Certificate Authority | An organisation browsers trust to vouch for who owns a domain. |
chain of trust | Root CA → intermediate → site cert; each link signs the next. |
cipher | The actual encryption algorithm (e.g. AES-GCM) used once a key is agreed. |
The whole idea: prove who you are with a signed certificate → use slow public-key maths once to agree a shared secret → encrypt everything else with the fast symmetric key. The padlock is the browser saying both checks passed.