How does TLS/HTTPS work?

Question

IT Interview Practice · Accepted Answer

**HTTPS is just HTTP running inside a TLS-encrypted channel.** TLS (Transport Layer Security) gives you three guarantees: **confidentiality** (traffic is encrypted), **integrity** (it can't be tampered with undetected), and **authentication** (you're really talking to the server named in the certificate). It's negotiated in a **handshake** before any HTTP is sent:

```text
Client                                   Server
  │──── ClientHello ──────────────────────▶│   (TLS versions, cipher suites, random)
  │◀─── ServerHello + Certificate ─────────│   (chosen cipher + cert with public key)
  │                                         │
  │  verify cert against a trusted CA       │
  │  agree on keys (e.g. ECDHE key exchange)│
  │                                         │
  │──── Finished (encrypted) ──────────────▶│
  │◀─── Finished (encrypted) ───────────────│
  │========= encrypted application data ====│   (now HTTP flows, encrypted)
```

The clever part is combining two kinds of crypto. **Asymmetric** cryptography (the certificate's public/private key pair) is used only briefly to *authenticate the server and safely agree on a shared secret*. That shared secret then keys fast **symmetric** encryption (like AES) for the bulk of the data — because asymmetric crypto is far too slow for every byte.

**Authentication** relies on the certificate chain: the server's certificate is signed by a **Certificate Authority (CA)**, and your OS/browser ships with a list of trusted CAs. If the chain is valid and the name matches, trust is established; if not (expired, self-signed, wrong host), the browser shows a warning. Modern **TLS 1.3** streamlines all this to a single round trip (0-RTT on resumption) and drops legacy, insecure ciphers.

## Why it matters

TLS underpins essentially all web traffic, so understanding it is table stakes for any backend, security, or infrastructure role. Interviewers use it to test whether you grasp the **hybrid crypto model** — asymmetric to establish trust and a shared key, symmetric for speed — which is a pattern that recurs across security systems. It's also intensely practical: expired certificates, untrusted chains, and protocol/cipher mismatches are common production incidents, and knowing how the handshake and certificate validation work is what lets you diagnose them quickly (e.g. with `curl -v` or `openssl s_client`).

Why it matters

Related questions