HTTPS / TLS, Explained

What the padlock in your browser actually means: how TLS adds encryption, integrity, and server authentication on top of plain HTTP, how the handshake agrees on a key, and how certificates and Certificate Authorities decide who to trust.

1. What HTTPS Protects (and Doesn't) TLS wraps plain HTTP in three guarantees - encryption so eavesdroppers can't read it, integrity so nobody can tamper with it undetected, and authentication so you know you reached the real server. The padlock proves the connection is encrypted to whoever holds the certificate; it does not prove the site is trustworthy or safe.
2. The Handshake & Keys How two strangers agree on a shared secret over an open wire: slow asymmetric (public/private key) cryptography is used to bootstrap trust and agree on a key, then fast symmetric encryption protects all the actual data. A walk through the TLS handshake with an ASCII diagram, and where TLS sits in the stack.
3. Certificates & Trust A certificate binds a domain to a public key and is signed by a Certificate Authority your browser already trusts - that chain of trust is what lets you believe you reached the real server. How Let's Encrypt made certificates free and automatic, and how to read certificate errors (expired, name mismatch, self-signed) calmly without clicking through warnings on real sites.