The padlock in your browser’s address bar is easy to take for granted. Behind it is SSL, or more accurately TLS, the technology that keeps data private as it travels between a visitor and a website. Here is how it works, without the jargon.

SSL, TLS and HTTPS

SSL stands for Secure Sockets Layer. It has been replaced by a newer, more secure protocol called TLS, or Transport Layer Security, but the name SSL has stuck. When people talk about an SSL certificate today, they almost always mean a certificate used with TLS.

HTTPS is simply the normal web protocol, HTTP, running over a TLS-encrypted connection. If a website address starts with https://, the connection between your browser and that site is encrypted.

What problem does it solve?

Information travelling across the internet passes through many networks on the way. Without encryption, anyone with access to one of those networks could, in principle, read or change it. That includes passwords, contact form messages and payment details.

TLS solves two problems at once. It encrypts the data so it cannot be read in transit, and it helps your browser confirm that it is talking to the genuine website rather than an impostor.

The handshake, simply explained

When your browser connects to a website over HTTPS, the two carry out a quick exchange called a handshake. The website presents its certificate, which contains its public key and details of the domain it belongs to.

Your browser checks that the certificate was issued by a trusted certificate authority, that it has not expired and that it matches the address you visited. If everything checks out, the browser and server agree on shared encryption keys for the session. From then on, everything sent between them is encrypted.

All of this happens in a fraction of a second, before the page starts to load.

What a certificate actually is

A certificate is a small digital file that ties a domain name to a public key. It is signed by a certificate authority, an organisation that browsers trust to verify that whoever requested the certificate controls the domain.

Most websites use domain validated certificates, which confirm control of the domain. Free certificate authorities such as Let’s Encrypt have made this kind of certificate widely available, and modern hosting can issue and renew them automatically.

Encryption in everyday terms

Encryption scrambles information using a key, so it looks like nonsense to anyone without the matching key. TLS uses two kinds. Public key encryption lets the browser and server agree on secret keys safely, even though they have never met. Faster symmetric encryption then protects the rest of the conversation. You do not need to understand the maths, just that the combination keeps your visitors’ data private on its way to your website.

Why every website needs HTTPS

It is not just for shops. Browsers now label plain HTTP pages as not secure, which can put visitors off before they read a word. Many modern browser features only work over HTTPS, and search engines have treated HTTPS as a positive signal for some time.

Even a simple brochure site usually has a contact form or a login page. HTTPS protects the information people type into those forms.

Common SSL questions

Does the padlock mean a site is trustworthy? It means the connection is encrypted and the certificate matches the domain. It does not, on its own, prove that the business behind the site is honest, so stay alert to phishing.

What is mixed content? If an HTTPS page loads images or scripts over plain HTTP, browsers may block them or show a warning. Updating those links to HTTPS fixes it.

Do certificates expire? Yes. Certificates have a limited lifespan, which is why automatic renewal is so useful.

SSL at RapidLayer

Free SSL certificates are included with every RapidLayer shared hosting plan, alongside malware protection, a firewall and daily backups. Read more on our security page or compare our web hosting plans.