SSL/TLS - How HTTPS Encrypts Your Connection

About 2 min read

SSL/TLS (Secure Sockets Layer / Transport Layer Security) is a protocol that encrypts communication over the internet. It encrypts data between web browsers and servers, preventing eavesdropping and tampering by third parties. TLS is the successor protocol to SSL, but the two are conventionally referred to together as SSL/TLS. The "S" in HTTPS refers to this technology.

Historical Background

SSL was developed by Netscape Communications in 1994. After SSL 2.0 (1995) and SSL 3.0 (1996), the IETF standardized TLS 1.0 in 1999. Serious vulnerabilities such as the POODLE attack were discovered in SSL 3.0, and its use is now prohibited. TLS 1.2 (2008) was the mainstream for a long time, but TLS 1.3 was finalized in 2018, achieving both faster handshakes and stronger security. When Google announced in 2014 that it would include HTTPS as a ranking factor, the move to HTTPS for websites accelerated rapidly, and as of 2025 more than 95% of web traffic is encrypted with HTTPS. Major browsers have completely ended support for TLS 1.0 and 1.1, and migration to TLS 1.3 has become the standard.

How SSL/TLS Works

In the TLS handshake, the server first presents a digital certificate to prove its identity. Next, the client and server securely exchange a shared cryptographic key and encrypt all subsequent communication with symmetric cryptography. In TLS 1.3, the handshake is simplified to 1-RTT (one round trip), improving both connection speed and security.

Where the Combination That Actually Gets Used Is Decided

Whether communication is encrypted is not settled by the list of versions a server says it supports. On every connection the combination actually used is chosen from among the methods both sides can use, so the outcome is decided by the overlap between what the server permits and what the connecting party asks for. Even where support for a newer method has been added, if permission for an older method has been left in place, that older method will be used with any party that asks for it. This list of permissions tends to move in one direction, towards growing. An entry gets added as the remedy when some party turns out to be unable to connect, and it stays there with no record of why it was added. Trying to remove it later calls for the information about why it is present, and that is not written in the configuration itself, so reviewing the list becomes less a technical task than a search for the grounds on which to decide. The other premise is that the permitted combinations have to be confirmed by connecting from outside. What is written as configuration and what is actually accepted do not always agree, whether because a default applies to an entry that was never written down, because a relaying device along the path holds a different setting, or because only some of several points of acceptance were configured differently. Where there are several points of acceptance, there is no guarantee that they are all in the same state at once, so confirmation has to be carried out at each of them. Managing this area is therefore not finished by settling on one version to use; it continues as the work of periodically confirming, from outside, the list of permitted combinations and whether that list is the same at every point of acceptance.

TLS Handshake Flow

Practical Considerations

SSL/TLS protects the communication path when passwords are transmitted. When entering a password in a login form, always confirm that the connection is HTTPS. A common pitfall in practice is overlooking the expiration of certificates. The spread of Let's Encrypt has made it possible to obtain certificates for free, but if you neglect to set up automatic renewal, the site can suddenly be shown as "not secure." In addition, servers that leave old TLS versions (1.0, 1.1) enabled carry a risk of vulnerabilities. No matter how strong a password you set, there is a risk of interception over unencrypted communication, so it is important to develop the habit of confirming that the lock icon appears in the browser address bar.