What Is SSL/TLS? How HTTPS Keeps Your Data Safe

SSL and TLS are cryptographic protocols that secure data in transit over the internet. TLS is what makes HTTPS work — encrypting the connection between your browser and web servers so that no one in between can read or tamper with the data.

What Is SSL/TLS?

SSL (Secure Sockets Layer) and its modern successor TLS (transport layer Security) are cryptographic protocols that provide secure communication over a network. They protect data in transit by encrypting the connection between two parties — most commonly your web browser and a web server.

When you see HTTPS and a padlock icon in your browser's address bar, TLS is working in the background to ensure:

  • Confidentiality — Your data is encrypted and unreadable to eavesdroppers.
  • Integrity — Data cannot be altered in transit without detection.
  • Authentication — You are actually talking to the legitimate server, not an impostor.

> Note: "SSL" is still widely used as a term, but SSL 2.0 and 3.0 are deprecated and broken. TLS 1.2 and TLS 1.3 are the current secure standards.

The TLS Handshake

Before any encrypted data is exchanged, the client and server perform a TLS handshake to negotiate encryption parameters and verify identity:

Client                                    Server
  |--- ClientHello (supported ciphers) ---→  |
  |  ←--- ServerHello (chosen cipher) ----  |
  |  ←--- Certificate (public key) -------  |
  | [Client verifies certificate]            |
  |--- ClientKeyExchange -------------------→ |
  |--- ChangeCipherSpec -------------------→ |
  |  ←--- ChangeCipherSpec ----------------  |
  |====== Encrypted data flows both ways ===|

TLS 1.3 (released 2018) simplifies this to a single round trip — making it faster while eliminating many legacy vulnerabilities.

Digital Certificates and PKI

How does your browser know it is talking to the real server? Through digital certificates and the public key Infrastructure (PKI).

Certificate Authorities (CAs)

A [certificate-explained) authority](/learning-center/what-is-a-digital-certificate-tls-certificates-and-pki-explained) is an organization trusted to verify identities and issue certificates. Major CAs include DigiCert, Sectigo, and Let's Encrypt (free, issues ~4 million certificates per day).

Certificate Chain of Trust

Root CA (trusted by your browser)
   └── Intermediate CA
          └── Server Certificate (mariamehwish.org)

If any certificate-explained) in the chain is invalid, expired, or untrusted, your browser shows a security warning.

Types of TLS Certificates

| Type | What It Validates | Best For | |------|------------------|----------| | DV (domain-kerberos-directory-services-explained) Validated) | Domain ownership only | Personal sites, blogs | | OV (Organization Validated) | domain-kerberos-directory-services-explained) + organization identity | Business websites | | EV (Extended Validation) | Full legal entity verification | Banks, e-commerce | | Wildcard | All subdomains (*.domain-kerberos-directory-services-explained).com) | Organizations with many subdomains |

Common TLS Attacks

Man-in-the-Middle (MitM)

An attacker positions themselves between client and server to intercept communications. TLS prevents this with certificate-explained) authentication — but MITM attacks are still possible when users click through certificate warnings.

Downgrade Attacks (POODLE, BEAST)

These attacks force a connection to use an older, weaker version of SSL/TLS. TLS 1.3 makes many downgrade attacks impossible by removing support for weak cipher suites entirely.

Weak Cipher Suites

Older servers may support weak ciphers like RC4 or export-grade encryption. Attacks like FREAK and LOGJAM exploited these.

Checking TLS Configuration

# Test a site's TLS configuration
openssl s_client -connect mariamehwish.org:443

# Check cipher suites (requires nmap)
nmap --script ssl-enum-ciphers -p 443 mariamehwish.org

# Use Qualys SSL Labs for a full online report
# https://www.ssllabs.com/ssltest/

Key things to check:

  • protocol version — TLS 1.2 minimum; TLS 1.3 preferred. Disable SSL 2.0/3.0, TLS 1.0, TLS 1.1.
  • cipher suites — prefer AES-GCM; disable RC4, DES, 3DES.
  • HSTS-security-headers-cors-CSP-hsts-explained) — tells browsers to always use HTTPS.

Quick Recap

  • TLS secures data in transit through encryption, authentication, and integrity checking.
  • The TLS handshake negotiates encryption and verifies the server's identity using digital certificates.
  • certificate-explained) Authorities (CAs) issue signed certificates that browsers trust.
  • TLS 1.3 is the current standard — faster and eliminates many legacy vulnerabilities.
  • Common attacks include MITM, downgrade attacks, and weak cipher exploitation.