← Back to Library • Web Development • Intermediate • 8 min read

How HTTPS Works: SSL/TLS Handshakes and Web Security

HTTPS (Hypertext Transfer Protocol Secure) extends HTTP by encrypting all communication between a user's browser and the web server using Transport Layer Security (TLS), preventing eavesdropping, tampering, and man-in-the-middle attacks.

💡 Plain-English Analogy

If standard HTTP is like sending a postcard where anyone handling your mail can read what is written, HTTPS is like putting your letter inside an unbreakable, tamper-evident steel lockbox that only the intended recipient possesses the key to unlock.

⚙️ Architecture & Under the Hood

HTTPS combines asymmetric cryptography (RSA or ECDHE) for initial mutual identity verification and key exchange with high-speed symmetric encryption (AES-GCM or ChaCha20-Poly1305) for ongoing session data encryption. Digital certificates signed by trusted Certificate Authorities (CAs) establish domain authenticity.

The TLS Handshake Step-by-Step

Before any encrypted data can be sent, the browser and server must complete a TLS handshake to negotiate cryptographic algorithms and establish a shared session key.

  • ClientHello: The browser announces its supported TLS versions and cryptographic cipher suites.
  • ServerHello: The server selects the strongest common cipher and presents its signed digital certificate.
  • Validation: The browser verifies the certificate chain up to trusted root Certificate Authorities installed in the OS.
  • Session Key: Both parties generate a temporary symmetric key used to encrypt subsequent HTTP traffic at lightning speed.
Client                                      Server
  │                                           │
  │─── 1. ClientHello (Cipher suites, TLS ver)─▶│
  │                                           │
  │◀── 2. ServerHello, Certificate, KeyExchange─│
  │                                           │
  │─── 3. Verify Certificate against root CAs─│ (Client validates trust)
  │─── 4. Client generates shared session key ─▶│
  │                                           │
  │◀════ 5. Secure Encrypted Session Active ════▶│ (Symmetric AES-256 GCM)

Frequently Asked Questions

Does HTTPS slow down website performance?

In modern networks, virtually no. Modern CPUs have hardware-accelerated AES instruction sets, and TLS 1.3 reduces the handshake overhead to a single network round trip (1-RTT).

Can someone see the URL path I am visiting with HTTPS?

Network eavesdroppers can see the domain name you are connecting to (via SNI and DNS), but the full URL path, query parameters, headers, and payload are 100% encrypted and invisible.