TLS is the reason a padlock appears in the browser. It protects the channel, not the honesty of the site.
The handshake, simplified
- Client and server agree on versions and cipher suites.
- The server presents a certificate and proves possession of the private key.
- The client validates the certificate chain against trusted roots and checks the name.
- Both derive session keys; application data is encrypted.
TLS provides confidentiality, integrity and server authentication. It does not protect the endpoint, the application logic or data after decryption.
Certificates and trust
A certificate binds a public key to a name and is signed by a certificate authority. The client trusts a set of root CAs; the chain must lead to one of them.
Things to check:
- the name matches the site;
- the certificate is current;
- the chain is complete;
- the issuing CA is trusted;
- revocation status is acceptable.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.