Demystifying HTTPS, SSL, and TLS

Every time you type a web address beginning with https:// or see a padlock icon in your browser's address bar, a sophisticated cryptographic choreography is taking place in milliseconds behind the scenes. But what exactly are HTTP, SSL, and TLS—and how do they work together to protect passwords, credit card numbers, and private data from eavesdroppers?

The History: From SSL to Modern TLS 1.3

Many developers use the terms SSL (Secure Sockets Layer) and TLS (Transport Layer Security) interchangeably, but technically they are distinct protocol versions. Netscape developed SSL 1.0 and 2.0 in the 1990s. However, critical cryptographic vulnerabilities forced the industry to deprecate SSL entirely.

Protocol Evolution Timeline

🔓

HTTP (Port 80)

Plaintext data transmission. Anyone on the same network can inspect or alter packets in transit.

⚠️

SSL 2.0 / 3.0

DEPRECATED: Flawed protocols vulnerable to POODLE, BEAST, and Man-in-the-Middle exploits.

🔒

TLS 1.2 (2008)

Strong security standard utilizing SHA-256 and AES encryption (requires 2 round-trip handshakes).

⚡

TLS 1.3 (2018-Present)

Modern, lightning-fast protocol removing obsolete ciphers and reducing latency to 1 round-trip (0-RTT resumption).

How HTTPS Works: Hybrid Cryptography

Pure Asymmetric encryption (RSA / ECC) is computationally expensive and slow for transferring large amounts of data. Pure Symmetric encryption (AES) is extremely fast, but requires sharing a secret key securely without eavesdroppers seeing it.

HTTPS Hybrid Encryption Model

HTTPS combines both! It uses Asymmetric Encryption during the initial handshake to securely establish identity and exchange a shared secret. Once established, it switches to ultra-fast Symmetric Encryption (AES-GCM or ChaCha20) for the actual session data flow.

Step-by-Step Breakdown of the TLS 1.3 Handshake

TLS 1.3 Handshake Flowhtml

1. ClientHello  -> Browser sends supported TLS version, supported ciphers, and a Diffie-Hellman Key Share.
2. ServerHello  -> Server selects cipher, generates its own Key Share, sends Digital Certificate & CA signature.
3. Certificate Verification -> Browser verifies Certificate Authority (e.g., Let's Encrypt / DigiCert) & expiry.
4. Session Key Derived -> Both sides calculate identical Session Keys independently using Diffie-Hellman.
5. Encrypted Application Data -> All HTTP requests & responses now flow with symmetric AES encryption!