Https
HTTPS is the secure form of HTTP: ordinary HTTP messages carried inside an encrypted, authenticated Transport Layer Security (TLS) connection, normally on port 443. It gives a browser three assurances that plain HTTP lacks: the server really is the one named in the address, the traffic cannot be read in transit, and it cannot be altered along the way without detection.
HTTPS is not a different protocol so much as HTTP wrapped in TLS, and TLS is the successor to Netscape's Secure Sockets Layer (SSL). SSL 1.0 was never released; SSL 2.0 appeared in 1995 and SSL 3.0 in 1996, and both are now considered broken. The IETF took over the design and published TLS 1.0 as RFC 2246 in 1999, followed by TLS 1.1, TLS 1.2 (RFC 5246, 2008) and TLS 1.3 (RFC 8446, 2018). Modern software disables SSL entirely and old TLS versions, and the phrase "SSL certificate" survives only as a habit: today's certificates are used with TLS.
The core of the design is a handshake that uses slow public-key cryptography once to agree on fast symmetric keys. The client says which versions and cipher suites it supports, the server answers with a certificate and key-exchange material, and both sides derive the same session keys without ever sending them; in TLS 1.3 this uses ephemeral Diffie-Hellman exchange, which provides forward secrecy, meaning that stealing the server's long-term key later cannot decrypt recorded traffic. After the handshake, the bulk of the data is protected with a symmetric cipher such as AES or ChaCha20 together with an authentication tag. TLS 1.3 needs only one round trip to set up, and can resume earlier sessions faster.
Identity rests on certificates and the trust chain behind them. A certificate, in the X.509 format, binds a domain name to a public key and is signed by a certificate authority (CA). Operating systems and browsers ship with a list of root CAs they trust, and a server presents a chain from its own certificate up to one of those roots. For years, certificates cost money and took manual effort, so many sites stayed on plain HTTP. Let's Encrypt, a nonprofit CA that opened to the public in 2015 and 2016, issues free certificates through an automated protocol, and that change helped HTTPS become the norm for most web traffic. Browsers now flag plain HTTP pages as "not secure," and HSTS, a response header, tells a browser to use only HTTPS for a site in future.
The padlock icon is the most misunderstood part of HTTPS. It means the connection to the named domain is encrypted and the certificate is valid for that name; it does not mean the site is honest, safe or free of malware, and criminals obtain certificates for look-alike domains as easily as anyone. HTTPS also does not hide everything: observers on the network can still see the destination IP address and, usually, the hostname through server name indication during the handshake, plus the amount and timing of traffic. And it protects the data only in transit: the server still receives the data in plain form and can mishandle it.
Practical consequences reach programmers and data practitioners daily. Web APIs, package registries and dataset downloads rely on HTTPS so that a model file or library cannot be silently swapped in transit. A script that disables certificate verification to silence an error, a common shortcut in Python and curl, removes the very authentication that makes HTTPS meaningful and invites interception. Certificates expire, often after weeks or a few months today, so automation for renewal is essential, and an expired certificate causes outages as loudly as a crashed server. Mixed content, where an HTTPS page loads scripts or images over HTTP, is blocked or warned about because it reopens the attack surface.
Read HTTPS as HTTP with a locked, verified envelope: the same requests and responses, but delivered through a TLS handshake in which a certificate vouches for the server's identity and fresh keys encrypt everything afterward, proving who you are talking to without proving they deserve your trust.