HTTPS & TLS
TLS
What it is
HTTPS is HTTP carried inside TLS: the client verifies the server’s identity against a certificate issued by a trusted authority, then negotiates an encrypted, integrity-checked channel before any application data is sent. TLS is the encryption and authentication protocol; HTTPS is the application of it to web traffic.
Why it matters
Without it, anything on the path can read and change the traffic: credentials, session cookies, form submissions, and the JavaScript the browser is about to run. That path includes cafés, hotels, corporate middleboxes and the hosting provider’s own network. It is no longer only about secrecy — a page served over HTTP can be modified in transit, so the user cannot trust what they see, and browsers now mark it explicitly as not secure. The protocol details belong to Networking Fundamentals; this entry is about what a developer is responsible for.
In this track
- Certificates and the handshake (07-security/02-https-tls/01-certificates-and-the-handshake) — what the certificate proves, who issues it, and how renewal goes wrong.
- Why plain HTTP is a hard fail (07-security/02-https-tls/02-why-plain-http-is-a-hard-fail) — the attacks it enables and the redirect and migration work it demands.
Prerequisites
- Networking Fundamentals (HTTP, DNS, TLS) (06-cloud-devops/10-networking-fundamentals-http-dns-tls)
Go deeper
- Networking Fundamentals (HTTP, DNS, TLS) (06-cloud-devops/10-networking-fundamentals-http-dns-tls) — read this first; the protocol layer this entry assumes.
- Web Security (OWASP Top 10) (07-security/01-web-security-owasp-top-10) — the application flaws that TLS does not fix.
- Content Security Policy (CSP) (07-security/06-content-security-policy-csp) — the browser-side control that complements an encrypted channel.
- Secrets Management (07-security/03-secrets-management) — what to do with an API key that travelled over a channel now known to be broken.