HTTPS is HTTP transmitted over an encrypted and authenticated TLS connection, replacing plaintext HTTP on port 443. When you visit an HTTPS site, your browser and the server perform a TLS handshake to establish a shared encryption key, verify the server's identity via an SSL certificate issued by a trusted certificate authority, and then encrypt all subsequent traffic.
How it works: The TLS handshake happens in one round-trip (TLS 1.3) or two (TLS 1.2). Your browser sends a ClientHello listing supported cipher suites and extensions like Server Name Indication (SNI). The server responds with its certificate chain, selected cipher, and a key-exchange parameter. Both sides compute a shared session key using ephemeral Diffie-Hellman or ECDHE. Your browser verifies the certificate chain up to a root CA and confirms the hostname matches the certificate. From that point on, HTTP requests and responses flow encrypted using AEAD ciphers like AES-GCM or ChaCha20-Poly1305.
Example:
When you navigate to https://example.com, the browser connects on port 443, performs the TLS handshake, verifies the certificate is valid for example.com, and then sends encrypted HTTP requests like GET / HTTP/1.1.
Key security properties: Confidentiality (eavesdroppers see only encrypted bytes), integrity (tampering is detected), and server authentication (you know you're talking to the real server, not an attacker). TLS 1.3 made forward secrecy mandatory, so even if a server's private key is compromised later, past sessions remain secure.
WarningTLS 1.0, 1.1, and SSL 3.0 are deprecated. Always use TLS 1.2 or 1.3. Modern certificate validity is capped at 398 days by CA policy.
Check your site's HTTPS setup with SSL check.