Beginner · 6 lessons

SSL & HTTPS

SSL/TLS certificates encrypt data between browsers and servers, protecting passwords, payment info, and personal data. HTTPS (HTTP over TLS) is mandatory for all websites — browsers mark HTTP sites as "Not Secure".

Key Concepts

TLS 1.2 / 1.3 Certificate Authority Let's Encrypt Certificate Types (DV/OV/EV) SSL Handshake HSTS Mixed Content Certbot

Key Takeaways

✓ Every website must use HTTPS — free with Let's Encrypt.
✓ TLS encrypts data in transit; it does not encrypt data at rest.
✓ Auto-renew certificates every 90 days with Certbot cron job.
✓ Fix mixed content warnings — load all assets over HTTPS.

Lessons in This Topic

SSL/TLS Fundamentals

How encryption protects web traffic.

TLS uses asymmetric encryption for key exchange, then symmetric encryption for data transfer. Certificate proves server identity (domain validation). Padlock icon in browser = encrypted connection. Without TLS, anyone on the network can read your traffic.

The SSL/TLS Handshake

Step-by-step connection establishment.

1) Client sends ClientHello with supported ciphers. 2) Server responds with certificate and ServerHello. 3) Client verifies certificate with CA. 4) Key exchange (ECDHE). 5) Both derive session keys. 6) Encrypted data transfer begins. TLS 1.3 completes in 1 RTT vs 2 RTT in TLS 1.2.

Let's Encrypt & Certbot

Free automated SSL certificates.

Let's Encrypt issues free DV certificates valid 90 days. Certbot automates issuance and renewal: `certbot --nginx -d example.com -d www.example.com`. Add cron job for auto-renewal. Most hosting panels (cPanel, Plesk) include one-click SSL.

Certificate Types: DV, OV, EV

Choose the right validation level.

DV (Domain Validation): automated, free, sufficient for most sites. OV (Organization Validation): verifies business identity. EV (Extended Validation): highest trust, green bar in old browsers. For blogs and business sites, free DV certs are perfectly adequate.

Fixing Mixed Content & HSTS

Common HTTPS migration issues.

Mixed content: page is HTTPS but loads HTTP images/scripts — browser blocks them. Fix: update all URLs to https:// or use relative paths. Enable HSTS header: Strict-Transport-Security: max-age=31536000 — forces HTTPS for 1 year. Add preload for maximum security.

Try the Interactive Simulator

1 Browser Query

2 Recursive Resolver

3 Root DNS

4 TLD Server

5 Authoritative NS

6 Response