Lesson 3 of 5 · reading 15–25 minutes; practice and project time is on the module page

TLS and certificates

🎯You'll be able to

Explain what HTTPS protects, check a site's certificate, and avoid common TLS mistakes.

🏠The everyday picture

A sealed envelope with the sender's verified stamp. Postal staff can see where it's going, but can't read or change the letter, and you can tell who sent it.

📘What it really is

TLS (Transport Layer Security) encrypts traffic between browser and server, checks it hasn't been changed, and proves the server's identity with a certificate. HTTPS is HTTP over TLS.
It doesn't protect data once it's on the server, or the page's content from flaws such as XSS. The padlock means the connection is private, not that the site is honest.
Certificates are issued by certificate authorities and expire. Free, automated authorities such as Let's Encrypt issue short certificates and renew them automatically.
Versions: use TLS 1.2 and 1.3; older versions should be turned off.
HSTS (Strict-Transport-Security) tells browsers to use HTTPS for the site from now on, so a first plain HTTP request can't be quietly downgraded.
Inside the network too: traffic between the app and the database, and between services, should also be encrypted where possible.
Expiry causes outages: monitor certificate dates and automate renewal.

📝A worked example

Input: you want to check the certificate of a site you own.

Steps:

In the browser, click the padlock and open the certificate details.
Note the name it was issued for, the issuer, and the expiry date.
Run openssl s_client -connect yoursite.example:443 -servername yoursite.example </dev/null on your own site and look for the protocol line.

Expected output: the site name matches, the expiry is in the future, and the protocol is TLS 1.2 or 1.3.

🌍Where it's used

Every bank, payment and login page.
App-to-API traffic in mobile apps.
Certificate monitoring in operations teams, to renew before expiry.

📝Case scenario

A popular food delivery app went down for hours because a certificate on an internal service expired over a weekend. No data was lost, but orders failed. They added expiry alerts at 30, 14 and 7 days, and automated renewal.

🖱️Try it

Open the certificate details for three sites you use. Success: you can name each certificate's issuer and expiry date.

⚠️Common mistakes

Thinking the padlock means safe. Sign: trusting a site because of it. Fix: it means private, not honest.
Manual renewal. Sign: a calendar reminder. Fix: automate renewal and alert on dates.
Turning off certificate checks in code. Sign: verify=False. Fix: fix the certificate problem instead.

🛠️For your project

The fixed AarogyaDesk sends Strict-Transport-Security, and the capstone notes say how certificates are renewed and monitored.

✅Quick check

What does the browser padlock tell you?

Show the answer

The connection is encrypted and the certificate matches the site's name; not that the site is trustworthy.

Why is HSTS useful?

Show the answer

It makes browsers use HTTPS for the site from then on, preventing downgrades to plain HTTP.