SSL and TLS Basics

A customer about to pay on the Hollow Oak Books site sees a padlock in the address bar and relaxes. What exactly is that padlock promising? It comes from TLS, the protocol that protects almost all web traffic, and knowing what it does, and does not, promise is basic defensive knowledge.

The rule

TLS proves who the server is and hides what you say.

SSL was the original protocol; it has been replaced by TLS (Transport Layer Security). People still say "SSL certificate" out of habit, but modern sites use TLS, and old SSL versions should be switched off because they have known weaknesses.

TLS gives three guarantees for the connection:

• Confidentiality — traffic is encrypted, so someone on the café Wi-Fi sees only scrambled data.
• Integrity — if anyone changes the data in transit, the change is detected.
• Authentication — the server shows a certificate proving it owns the name, signed by a certificate authority the browser already trusts.

What TLS does not promise: that the site is honest. A criminal can get a valid certificate for hollow-oak-b00ks.example. The padlock means "private connection to this name", not "good people".

The shortcut

When you see a padlock, read it as "encrypted, and really this name", then check the name yourself.

For the shop, this means: keep the certificate renewed before it expires (many hosts do this automatically), redirect all HTTP to HTTPS, and allow only modern TLS versions. For staff: never click through a certificate warning, and check the domain spelling, not just the padlock.

Drills

Answer fast — trust the rule.

Remember

• TLS proves who the server is and hides what you say. SSL is its retired ancestor.
• Read a padlock as "encrypted, and really this name", then check the name.
• Trap: trusting the padlock alone, or clicking through certificate warnings.