HTTPS and TLS

Cybersecurity Foundations (Grades 6–8) · lesson 25 of 48 · 10 min

How HTTPS Protects Every Website You Visit

Every time you see a padlock icon in your browser’s address bar, HTTPS is protecting your connection. HTTPS (HyperText Transfer Protocol Secure) is the secure version of HTTP — the protocol that transfers web pages. The “S” stands for Secure, and it is provided by TLS (Transport Layer Security).

Before HTTPS became widespread, browsing the web was like sending postcards — anyone who could intercept your traffic could read everything. Your passwords, your messages, your payment details — all visible in plain text. HTTPS changed that by encrypting every byte of data between your browser and the server.

By the end of this lesson you will be able to explain what HTTPS protects, describe how the TLS handshake works, explain the role of Certificate Authorities, identify the current TLS version, and explain the critical HTTPS misconception about phishing sites.

HTTPS adoption

In 2014, only about 30% of web traffic was encrypted. Google began penalising HTTP sites in search rankings in 2014 and marking them as “Not Secure” in Chrome in 2017. By 2024, over 95% of web traffic is encrypted with HTTPS. This shift represents one of the most significant improvements in internet security in history.

HTTPS and the Padlock

HTTPS (HyperText Transfer Protocol Secure) is HTTP with an added layer of encryption provided by TLS (Transport Layer Security). It protects three things:

Confidentiality — data is encrypted so only you and the server can read it. No one intercepting the traffic can see your passwords or credit card numbers.

Integrity — data cannot be modified in transit. If someone tampers with the data, the connection fails.

Authentication — you are actually talking to the real website, not an imposter. Verified by a digital certificate from a trusted Certificate Authority.

The padlock icon in your browser means the connection is encrypted with HTTPS. Always look for it before entering passwords or payment information.

How TLS Works

The TLS handshake happens automatically when you connect to an HTTPS site:

Client Hello — your browser says “I want to connect securely” and lists supported TLS versions and cipher suites.
Server Hello — the server picks a cipher suite and sends its digital certificate (containing its public key).
Certificate verification — your browser checks the certificate was issued by a trusted CA and has not expired.
Key exchange — browser and server use asymmetric encryption to agree on a symmetric session key.
Encrypted communication — all further communication uses the symmetric session key (AES).

TLS versions: TLS 1.3 is the current standard (2018). TLS 1.2 is still widely used. TLS 1.0 and 1.1 are deprecated and insecure. SSL (the predecessor to TLS) is completely obsolete.

HSTS (HTTP Strict Transport Security) — a header that tells browsers to always use HTTPS for a domain, preventing downgrade attacks.

HTTPS misconception

HTTPS means the connection is encrypted — it does NOT mean the website is safe or legitimate. Phishing sites can and do use HTTPS. Always verify the domain name, not just the padlock.

Key Terms

Real-World Case Studies

Case 1: The Superfish Incident (2015)

Lenovo pre-installed adware called Superfish on consumer laptops. Superfish intercepted HTTPS connections by installing its own root certificate — making it a trusted CA on the device. This allowed Superfish to decrypt, read, and re-encrypt all HTTPS traffic, including banking and email. Security researchers discovered that Superfish’s certificate used a weak, easily crackable private key — meaning any attacker who cracked it could intercept HTTPS traffic on all affected Lenovo laptops. The lesson: the TLS trust model depends on CAs being trustworthy. A compromised or malicious CA breaks HTTPS security entirely.

Case 2: Let’s Encrypt — Free HTTPS for Everyone (2016)

Before 2016, getting an HTTPS certificate cost money and required manual processes — a significant barrier for small websites. Let’s Encrypt launched as a free, automated Certificate Authority. By 2024, it had issued over 3 billion certificates and was responsible for a large portion of the HTTPS adoption surge. The lesson: removing barriers to security adoption has a massive positive impact. Making HTTPS free and easy dramatically improved internet security for everyone.

Activity — HTTPS Scenarios

HTTPS Real-World Decisions

Knowledge Check

HTTPS protects which three properties?

Speed, reliability, compatibility
Confidentiality, integrity, authentication
Privacy, anonymity, security
Encryption, compression, caching

Answer: Confidentiality, integrity, authentication
HTTPS/TLS provides: confidentiality (encrypted), integrity (not tampered), authentication (real website via certificate).

The padlock icon in your browser means:

The website is safe and legitimate
The connection is encrypted
The site has been verified as trustworthy
Your data is backed up
Answer: The connection is encrypted

The padlock means the connection is encrypted with HTTPS. It does NOT mean the site is safe — phishing sites use HTTPS too. TLS 1.3 is preferred over older versions because:

It is slower but more secure
It is faster and more secure with fewer vulnerabilities
It is compatible with more devices
It uses symmetric encryption only
Answer: It is faster and more secure with fewer vulnerabilities

TLS 1.3 removed weak cipher suites, reduced handshake steps, and improved performance. TLS 1.0/1.1 are deprecated. A Certificate Authority (CA) is responsible for:

Encrypting web traffic
Issuing digital certificates that verify website identity
Managing DNS records
Providing IP addresses
Answer: Issuing digital certificates that verify website identity

CAs are trusted third parties that verify a website’s identity and issue certificates. Your browser trusts a list of root CAs.

A phishing site can use HTTPS.

Answer: True
HTTPS only means the connection is encrypted. Attackers can get free TLS certificates for their phishing domains. Always check the domain name.

HSTS (HTTP Strict Transport Security) prevents:

Phishing attacks
Downgrade attacks that force HTTP instead of HTTPS
Certificate forgery
DDoS attacks
Answer: Downgrade attacks that force HTTP instead of HTTPS

HSTS tells browsers to always use HTTPS for a domain — preventing attackers from forcing a downgrade to unencrypted HTTP.

Previous lesson: Symmetric vs. asymmetric encryption
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Windows users and accounts