HTTPS and certificates: what the padlock proves and what it doesn’t

The first lesson mentioned that https:// addresses use encryption. This lesson looks closer at how that encryption is set up, what the padlock icon in your browser is actually vouching for, and where its guarantee stops.

TLS: the protocol behind the padlock

HTTPS is the ordinary web protocol, HTTP, run inside Transport Layer Security (TLS), a protocol first published in 1999 and now in its 1.3 version. Cloudflare’s Learning Center summarises what TLS accomplishes in three parts: encryption, which hides the data from anyone else on the network; authentication, which checks that you are talking to the server you think you are; and integrity, which detects if the data was altered in transit. Before any content is exchanged, your Mac and the server perform a “TLS handshake”: they agree on a version of TLS, agree on the cryptographic methods to use, and generate the keys that will encrypt the rest of the session.

What a certificate actually certifies

For that handshake to mean anything, your browser needs proof that the server’s public key really belongs to the site you typed. That proof is the TLS certificate. According to Cloudflare, a certificate bundles the domain name, the public key, an expiry date, and the digital signature of whoever issued it: a certificate authority (CA), an organisation your browser and operating system already trust. Let’s Encrypt, a widely used, free certificate authority, describes the process plainly: before it will issue a certificate, its software checks that the requester actually controls the domain, for example by asking them to publish a specific file on that website or a specific DNS record. Only after that check does it sign a certificate.

This matters because it defines the limit of what a standard certificate proves. It proves that whoever requested it controls the domain name at that moment. It does not vet the business behind the site, check whether the operator is honest, or promise that the content is safe. Anyone, including a scammer, can register a domain and obtain a valid certificate for it in minutes.

Reading the padlock correctly

The Electronic Frontier Foundation’s Surveillance Self-Defense guide puts the underlying point directly: “Just because a service uses HTTPS does not mean that the service fully protects the privacy of its users.” HTTPS protects the pipe; it says nothing about what the destination does with what arrives through it. The same guide notes that HTTPS hides which page on a site you visited from network eavesdroppers, but the site itself still receives everything you type — searches, messages, logins — in the clear, because it is the other end of the encrypted connection, not an observer of it.

Self-signed and expired certificates

Cloudflare also explains what happens without a trusted certificate authority: anyone can generate their own “self-signed” certificate, but browsers have no outside authority to check it against, so they mark such sites as not secure or refuse to load them outright. An expired certificate produces a similar warning. Neither warning necessarily means an attack is happening, but it does mean the browser cannot currently verify who it is talking to, which is exactly the check TLS is meant to provide.