SSL certificates and HTTPS explained
SSL certificates and HTTPS explained
HTTPS stands for Hypertext Transfer Protocol Secure. It is the secure version of HTTP, the protocol used to exchange data between a web browser and a web server. When a user visits a website via HTTPS, this is visibly shown in the browser's address bar. According to the Dutch Ministry of the Interior, the presence of HTTPS in the URL means that the website is secured with a TLS certificate. This certificate ensures that the communication between the user and the website is encrypted, so that third parties cannot read the content of the traffic.
TLS stands for Transport Layer Security. It is a cryptographic protocol that secures data transmission between systems. According to the same government source, TLS ensures that data between user and website, or between systems with each other, is encrypted and made unreadable to unauthorized parties. This means that sensitive information such as passwords, credit card details or personal messages cannot be intercepted by malicious actors eavesdropping on the network.
Although people often speak of SSL certificates, the technology that is actually used now is TLS. SSL, or Secure Sockets Layer, was the predecessor of TLS. SSL was developed in 1994 by the American company Netscape. It was intended to establish a secure connection over the internet. Over the years, weaknesses in SSL were discovered, which is why the protocol was replaced by its safer successor: TLS. Nevertheless, in practice people still often speak of an SSL certificate, while in reality it concerns a TLS certificate. Technically speaking, HTTPS is therefore nothing other than HTTP with TLS encryption. This means that standard web traffic gets an extra layer of security by using the TLS protocol.
An SSL or TLS certificate has two important functions. First, it provides encryption of the traffic between the browser and the server. Second, it verifies the identity of the server. This dual function is explained by V-Web: the certificate not only prevents data from being eavesdropped on, but also ensures that the user is actually communicating with the website they think they are on, and not with a fake site. Without this verification, an attacker could set up a false website that looks identical, and thus steal data — a so-called man-in-the-middle attack.
The certificate is issued by a trusted third party, known as a certificate authority or Certificate Authority (CA). According to SSLmentor, the CA checks the identity of the applicant — usually the owner of the web server — before the certificate is provided. This verification is crucial: only if the CA is certain of the identity of the applicant is the certificate issued. Well-known CAs include DigiCert, Let’s Encrypt and Sectigo. Browsers and operating systems contain a list of trusted CAs. If a certificate is issued by a CA that is not on that list, the browser warns the user that the connection is not trusted.
During secure HTTPS communication, a so-called handshake takes place between the browser and the server. According to SSLmentor, in this handshake information about the desired encryption method and cryptographic keys is exchanged. The handshake begins when the browser tries to make a connection with an HTTPS website. The server responds by sending its certificate. The browser then checks whether the certificate is valid, whether it was issued by a trusted CA, whether it has not yet expired, and whether the domain in the certificate matches the website being visited. If all these checks are positive, the browser generates a session key, encrypts it with the public key from the certificate, and sends it to the server. The server decrypts the session key with its private key, and from that moment on both parties use that session key to encrypt the rest of the communication. This process ensures a secure, authenticated and encrypted connection.
A TLS certificate contains several pieces of information. According to Securist, a certificate contains at least three types of data: the domain name of the website, a digital signature of the web server and a digital signature of the certificate authority (CA). The domain name ensures that the certificate is only valid for a specific website or domain. The digital signature of the server confirms that the server is in possession of the corresponding private key. The signature of the CA confirms that the CA has verified the identity of the applicant. Together these elements form a chain of trust.
In the browser, the user can often view this information by clicking on the padlock next to the URL. There, among other things, the name of the issuing authority and the company name of the website's owner appear. This is described in DigiCert's Dutch explanation. This transparency helps users to check whether they are dealing with a legitimate organization. For example: if a user logs in to a bank's website, they can check whether the certificate was actually issued in the name of that bank, and not in the name of an unknown company.
HTTPS and TLS are not only important for websites that log in or process payments. HTTPS is also essential for regular information and news websites. Without encryption, internet providers, government agencies or hackers can see users' browsing behavior, the pages that are clicked on, and even text that is typed. HTTPS prevents this. That is why organizations such as the Dutch government advise using HTTPS/TLS certificates, including on government websites. This is an official recommendation, based on the need to safeguard the privacy and security of citizens when using government services.
The use of HTTPS has now become a standard. For example, Google Chrome requires websites without HTTPS to be marked with a warning. Modern browsers sometimes even block functions on unencrypted sites. In addition, HTTPS websites often improve their position in search engines, because Google uses security as a ranking signal.
In summary, an SSL or TLS certificate is a technical means that arranges two things: encryption of the traffic and verification of the server identity. The certificate is issued by a certificate authority that verifies the applicant. With an HTTPS connection, a handshake takes place in which encryption information is exchanged. The certificate contains data such as the domain name, the digital signature of the server and that of the CA. HTTPS is therefore HTTP with TLS encryption, and ensures that data between user and server remains safe and private. The Dutch government, like other official bodies, emphasizes the importance of this technology for secure online communication.