Demystifying HTTPS: How Encryption and Certificates Secure the Web

What Is HTTPS?

HTTPS is simply HTTP with an added "S", which stands for SSL/TLS – a security protocol that encrypts data packets transmitted over HTTP.

The two primary goals of HTTPS are:

Encrypt data

Verify the server’s identity

How HTTPS Encrypts Data

HTTPS uses two kinds of encryption:

Symmetric encryption: Both client and server share the same secret key for encryption and decryption.

Asymmetric encryption: A pair of keys – a public key (shared openly) and a private key (kept secret) – are used. Data can be encrypted with one key and decrypted with the other.

HTTPS combines these methods in a hybrid approach:

The client generates a random session key (symmetric key).

The session key is encrypted with the server’s public key (asymmetric) and sent to the server.

The server decrypts the session key using its private key.

Both parties now use the shared session key for fast symmetric encryption of the actual data.

Even if an attacker intercepts the encrypted session key, they cannot recover it without the server’s private key.

How HTTPS Verifies Server Identity

Beyond encryption, HTTPS ensures the server is genuine using digital signatures:

A hash function creates a message digest of the data.

The server encrypts this digest with its private key, producing a digital signature.

The client validates the signature by:

Decrypting the signature with the server’s public key to obtain the original digest.

Computing a fresh digest of the received data using the same hash algorithm.

Comparing the two digests; a match means the data has not been altered.

If the server’s public key were forged, the client could be deceived. To prevent this, HTTPS employs digital certificates issued by trusted Certificate Authorities (CAs).

Digital Certificate Verification

The verification process includes:

Checking the certificate’s owner, validity period, and other fields.

Ensuring the issuing CA is trusted by comparing it with the list of built‑in CAs in the operating system.

If trusted, the browser retrieves the CA’s public key and uses it to decrypt the certificate’s signature.

The browser computes a hash of the certificate’s contents and compares it with the decrypted value.

When the hashes match, the certificate is authentic, and the browser extracts the server’s public key for subsequent encryption.

HTTPS Overview Diagram