Video: Transport Layer Security (TLS) — Computerphile. Embedded from YouTube in privacy-enhanced mode; all rights belong to the creator.
The padlock in your browser means your connection uses HTTPS — HTTP carried inside TLS (Transport Layer Security). TLS gives three guarantees: confidentiality (eavesdroppers can't read the traffic), integrity (nobody can alter it in transit) and authentication (you're talking to the real owner of the domain). It does not mean the site itself is trustworthy — phishing sites get certificates too.
The handshake in TLS 1.3
- ClientHello. Your browser sends supported cipher suites and a key share for an ephemeral Diffie-Hellman exchange.
- ServerHello. The server picks parameters and sends its own key share. Both sides can now derive shared session keys — without ever sending them over the wire.
- Certificate and proof. The server sends its certificate chain and signs the handshake with its private key, proving it controls the certificate.
- Finished. Both sides confirm the handshake wasn't tampered with, then encrypted application data flows.
TLS 1.3 (RFC 8446) completes this in one round trip, removes obsolete algorithms, and makes forward secrecy mandatory: even if the server's private key leaks later, past sessions stay secret.
Certificates and the chain of trust
A certificate binds a domain name to a public key, signed by a Certificate Authority (CA). Your operating system or browser ships with a list of trusted root CAs; the server presents its own certificate plus intermediate certificates linking back to one of those roots. Free, automated CAs such as Let's Encrypt made HTTPS the default across the web. You can restrict which CAs may issue for your domain with a CAA record — check it with our DNS lookup.
Common errors and what they mean
| Error | Likely cause |
|---|---|
| Certificate expired | Renewal failed — automate it |
| Name mismatch | Certificate doesn't cover this hostname (e.g. missing www) |
| Untrusted issuer | Self-signed cert or missing intermediate |
| Mixed content | HTTPS page loading HTTP scripts or images |
| Clock errors | Device date/time is wrong |
Hardening checklist for site owners
- Redirect all HTTP to HTTPS with a 301.
- Enable HSTS so browsers refuse plain HTTP in future.
- Support TLS 1.2 and 1.3 only; disable older versions.
- Automate certificate renewal and monitor expiry.
- Fix mixed content — browsers increasingly block it outright.
Try the tools
DNS Lookup
Query A, AAAA, MX, TXT, NS, CNAME, CAA and more records.
HTTP Status Codes Reference
Searchable list of 1xx–5xx codes with plain-English meanings.
Hash Generator (MD5, SHA-256…)
Live MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text.