What is HTTPS, and what does TLS add on top of HTTP?

HTTPS = HTTP over TLS. TLS provides three things: encryption (no eavesdropping), integrity (no tampering), and authentication (you're really talking to who you think you are).

The stack:

HTTP                              ← Application data (unchanged)
TLS  (Transport Layer Security)   ← Adds encryption + integrity + auth
TCP                               ← Reliable transport
IP                                ← Routing

Three guarantees:

Why all three matter:

Encryption alone isn't enough. Without integrity, an attacker could flip bits in your traffic. Without authentication, you might encrypt to the wrong party.

TLS handshake (simplified):

1. Client → Server: ClientHello with supported cipher suites + random number
2. Server → Client: ServerHello picking one cipher, sends certificate + random
3. Client verifies certificate against trusted CA list
4. Both derive a shared session key (via ECDHE key exchange)
5. ChangeCipherSpec — switch to encrypted communication
6. All subsequent HTTP traffic encrypted with the session key

HTTPS vs HTTP at the URL level:

Same protocol semantics, different default port:

• HTTP → port 80
• HTTPS → port 443

The certificate trust chain:

Your browser trusts → Root CA (Let's Encrypt, DigiCert, ...)
Root CA signs       → Intermediate CA
Intermediate signs  → Server's certificate
Server presents     → Certificate during handshake

If any link is broken or untrusted, your browser shows the scary red warning.

Tip: TLS 1.3 (2018) simplified the handshake to 1-RTT (or even 0-RTT for resumption) and dropped weak ciphers. If a server still uses TLS 1.0/1.1, it's deprecated and unsafe — modern browsers refuse them.

Go deeper:

• Transport Layer Security (Wikipedia) — handshake walkthrough across TLS 1.2 vs 1.3, cipher suites, and the certificate trust chain.