We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningFoundation · Core Fundamentals
HTTP over TLS: the encrypted version of HTTP that protects data in transit. Every production site should use it; browsers flag plain HTTP as insecure.
In short
HTTPS is HTTP sent over a TLS-encrypted connection, so the request and response are scrambled in transit and cannot be read or tampered with by anyone between the browser and the server. It also proves you are actually talking to the real site through a certificate signed by a trusted authority.
In short
HTTPS is HTTP sent over a TLS-encrypted connection, so the request and response are scrambled in transit and cannot be read or tampered with by anyone between the browser and the server. It also proves you are actually talking to the real site through a certificate signed by a trusted authority.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers HTTPS across a run of lessons, not one page. These 3 alone are about 54 minutes of step-by-step reading, every one with a quiz.
The protocol that encrypts data in transit between clients and servers, the S in HTTPS.
Protecting data as it travels across networks, preventing eavesdropping and tampering.
How SSL/TLS certificates prove who a website is. Compares DV, OV and EV certificates, and walks through the certificate trust chain.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Transport Layer Security (TLS)pay once,
yours for life
HTTPS stands for HTTP Secure. It is the exact same HTTP protocol your browser already uses to fetch pages and call APIs, except every byte travels inside an encrypted TLS tunnel instead of plain text. The S is the only difference, and it changes everything about who can see and modify the traffic.
Plain HTTP sends everything in the clear. Anyone on the path, a coffee-shop Wi-Fi operator, an ISP, a compromised router, can read your passwords, cookies, and form data, and can even inject content into the page. HTTPS closes that hole by giving you three things at once: confidentiality so eavesdroppers see only ciphertext, integrity so tampering is detected and rejected, and authentication so you know the server is who it claims to be.
HTTPS normally runs on TCP port 443, while plain HTTP uses port 80. The protocol underneath the encryption is unchanged, which is why moving a site to HTTPS rarely requires rewriting application code.
When you connect, the browser and server run a TLS handshake before any HTTP data is sent. The browser says hello and lists the TLS versions and cipher suites it supports. The server picks one and sends back its certificate, a file signed by a Certificate Authority such as Let's Encrypt or DigiCert that binds the domain name to a public key.
The browser checks that certificate against its built-in list of trusted CAs, confirms it has not expired, and confirms the name matches the site you asked for. If anything fails, you get the red warning page. If it passes, the two sides use public-key cryptography to agree on a shared symmetric session key. Modern TLS 1.3 uses an ephemeral Diffie-Hellman exchange, which gives forward secrecy: even if the server's long-term key leaks later, past recorded sessions stay unreadable.
Once the key is agreed, the rest of the conversation is encrypted with fast symmetric ciphers like AES-GCM or ChaCha20. TLS 1.3 trimmed the handshake to a single round trip, and session resumption can make repeat visits effectively zero round trips, so the latency cost is small.
The answer today is always. Every production site should serve HTTPS only and redirect HTTP to it. Chrome and Firefox label plain HTTP pages as Not Secure, browser features like service workers, HTTP/2, geolocation, and the camera API refuse to run without it, and Google uses HTTPS as a ranking signal. There is no real case for serving public traffic over HTTP anymore.
The cost is small but real. There is the one-time handshake overhead per connection, certificate management, and the discipline of renewing certificates before they expire. Let's Encrypt made certificates free and automatable, and tools like Certbot or the cert handling built into nginx, Caddy, and cloud load balancers renew them on a schedule, so a forgotten renewal causing an outage is the main risk to watch.
One limit worth knowing: HTTPS encrypts the request path, headers, and body, but the server's IP address and the destination hostname in the older SNI field are still visible to network observers. Encrypted Client Hello is the newer fix that hides the hostname too, but it is not yet universal.
Type https://www.cloudflare.com into a browser and watch what happens. The browser opens a TCP connection to port 443, runs the TLS 1.3 handshake, validates Cloudflare's certificate against a trusted CA, and derives a session key. The TLS part takes roughly one round trip, on top of the round trip that opens the TCP connection.
From that point the GET request for the HTML, the response, your cookies, and every image and script are encrypted with AES. A network sniffer on the same Wi-Fi sees only that you connected to a Cloudflare IP on port 443 and some encrypted blobs. It cannot read the page, steal your session cookie, or inject a fake login form.
This is why banks, every login page, and payment flows depend on HTTPS. Without it, a single attacker on the network could capture credentials in plain text or quietly rewrite the page you see.
Let's Encrypt
Nonprofit CA that issues free 90-day certificates and pioneered the ACME protocol so renewal is fully automated; it secures hundreds of millions of domains.
Cloudflare
Terminates TLS at its edge for millions of sites, offering free universal HTTPS and pushing adoption of TLS 1.3 and Encrypted Client Hello.
Google Chrome
Marks plain HTTP pages as Not Secure and gates modern web APIs behind a secure context, which forced the web-wide shift to HTTPS.
nginx
Common reverse proxy and web server that terminates TLS and redirects port 80 traffic to 443 for the apps behind it.
They are the same protocol, but HTTPS wraps the traffic in a TLS encrypted tunnel. HTTP sends data as readable plain text on port 80, while HTTPS sends encrypted, integrity-protected data on port 443 and verifies the server's identity with a certificate.
No. TLS is the encryption protocol; HTTPS is just HTTP running on top of TLS. SSL is the old, now-broken predecessor of TLS that you should never enable, even though people still say SSL certificate when they mean TLS certificate.
Barely. The TLS handshake adds a small one-time cost per connection, but TLS 1.3 needs only one round trip and session resumption removes most of that on repeat visits. HTTPS is also required to use HTTP/2 and HTTP/3, which usually make sites faster overall.
Only partly. HTTPS proves the connection is encrypted and that you reached the domain in the certificate, but a phishing site can also get a valid certificate for its own lookalike domain. HTTPS protects the channel, not the honesty of the people running the server.
For most sites, free and automatically. Use Let's Encrypt with a client like Certbot, or let a host such as Cloudflare, Caddy, Vercel, or a cloud load balancer provision and renew certificates for you. Paid certificates exist for extended validation but are rarely necessary.
HTTP
The protocol powering the web. A request-response model where clients ask for resources and servers respond. Stateless by design.
SSL/TLS
Cryptographic protocols that encrypt data in transit between client and server. TLS is the modern successor to SSL. The 'S' in HTTPS.
TCP
A reliable transport protocol that guarantees data arrives in order and without errors. It uses a three-way handshake to establish connections.
Latency
The time delay between sending a request and getting a response. Amazon found every 100ms of extra latency costs 1% in sales.
Throughput
The number of operations a system can handle per unit of time. Think of it as how many cars a highway can move per hour.
Bandwidth
The maximum amount of data that can be transferred over a network in a given time. It's the width of the pipe, not how fast the water flows.
This page explains the idea. The "Transport Layer Security (TLS)" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Transport Layer Security (TLS) lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about HTTPS in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
