HTTPS Encryption Explained in 5 Minutes: SSL Handshake, Certificates, MITM Attacks

1. What the "Green Padlock" Really Is

When you open Chrome / Safari / Edge, you'll see a small padlock on the left of the address bar. Click it and you'll see something like:

• "Connection is secure"
• "Certificate is valid"
• "This site uses HTTPS"

These three lines actually tell you 3 things:

1. Content between you and the site is encrypted — even if intercepted, attackers can't read it
2. You are connected to the real site, not an imposter (identity verification)
3. The certificate was issued by a CA your browser trusts (third-party endorsement)

The green padlock is not a guarantee that "this site is good". It's a guarantee that "the communication line between you and this site is safe".

So how does "encryption" actually work? Let's get to the SSL handshake.

2. The SSL Handshake: What Browser and Server Secretly Exchange

The real SSL handshake is far more complex, but the essence is just 4 steps:

1. Say Hello (Client Hello)
   The browser says: "Hi, I support TLS 1.3, here's a list of encryption algorithms I can use." — Telling the server "I speak these languages, pick one".
2. Show ID (Server Hello + Certificate)
   The server says: "OK, let's use TLS 1.3 + AES-256." Then it produces a digital certificate — this is what the browser checks. The certificate contains the website name, public key, issuing authority, and validity period.
3. Verify the ID (Certificate Validation)
   After receiving the certificate, the browser checks: "Which CA signed this? Do I trust this CA? Does the domain on the certificate match the URL I'm visiting? Is the certificate expired?" — Only if all pass does it proceed.
4. Agree on a Secret Code (Key Exchange)
   Browser and server use an ingenious mathematical method (Elliptic Curve Diffie-Hellman) to compute the same key on a public channel — this key is never transmitted over the network.

Step 4 is the most brilliant part:

From this point on, all conversation between browser and server is encrypted with this shared key. Even if a hacker monitors everything in the middle, all they see is gibberish.

3. Certificates = Server's ID Card

In Step 2, what exactly is the "digital certificate" the server presents?

You can think of it as an electronic ID card:

Certificate content (simplified):
- Holder: www.baccpc.com
- Public key: 04A8F2E91B... (256-bit hex)
- Validity: 2026-08-27 to 2026-11-25
- Issuer: ZeroSSL DV CA
- Signature: 9F7B11CFA5... (signed with CA's private key)

The key question is: who guarantees this certificate is real?

This is what the CA (Certificate Authority) does. A CA's job is simple:

1. Verify you actually own this domain (have you add a DNS record, or modify a website file)
2. Use the CA's own private key to sign the certificate
3. Attach this signature to the certificate

Browsers ship with 100+ CA public keys built in (maintained by Mozilla). When the browser receives a server certificate, it uses the corresponding CA's public key to verify the signature — if it can be decoded, the certificate was really signed by that CA.

Free certificates vs paid certificates:

For 99% of small websites, free DV certificates are completely sufficient. My own baccpc.com uses ZeroSSL's free 90-day certificate, auto-renewing every 3 months.

4. Man-in-the-Middle Attacks: What Happens Without HTTPS

Now that we understand certificates, let's see why the absence of HTTPS is risky.

Imagine you connect to WiFi at a coffee shop, but this WiFi is actually set up by a hacker (disguised as the shop's free WiFi). You open baidu.com, see the normal page, and type a search query.

If you accessed the HTTP version of Baidu, the hacker can do these things:

This type of attack is called MITM (Man-In-The-Middle, man-in-the-middle attack):

• The hacker disguises as a WiFi hotspot, intercepting all your HTTP requests
• Your requests pass through him in plain text, and his responses do too
• He can see all your browsing content, modify web pages (e.g., change the bank's transfer destination to his own account), inject ads or malicious code

This actually happens in public WiFi environments. Airports, coffee shops, and hotels have all had documented cases.

After installing HTTPS, what can the middleman see?

GET /login HTTP/1.1
Host: www.baccpc.com
[Encrypted gibberish: a8f2e91b7c4d...]

Middleman sees: gibberish
Can he modify it? Browser will error out
Can he replay it? No, timestamp + nonce protection

This is why Chrome has shown red "Not Secure" for all HTTP sites since 2017:

5. Why ZeroSSL / Let's Encrypt Made HTTPS Free

Before 2014, installing HTTPS cost hundreds to thousands of CNY per year, and the process was complex (you had to mail business licenses, make phone verifications). This made HTTPS unaffordable for 90% of small sites, which in turn made "encrypt the entire web" an empty promise.

Let's Encrypt burst onto the scene in 2014 and did one thing: fully automate the certificate issuance process. You run a small tool, it automatically verifies the domain, automatically issues, automatically deploys to the server, and auto-renews every 90 days — completely free.

The sponsors are Mozilla, Cisco, Akamai, and the Electronic Frontier Foundation — they believe "HTTPS should be like HTTP by default: free".

ZeroSSL is another service providing free DV certificates, 90-day validity, even simpler operation than Let's Encrypt (pure web UI, no command line), and I'm using it myself.

Difference between the two:

• Let's Encrypt: 90 days, requires certbot CLI tool, Linux-friendly, Windows is harder
• ZeroSSL: 90 days, pure web UI, DNS verification, equally easy on Windows / Mac / Linux
• Cloudflare: Free cert signed behind the scenes, auto-renewal, but traffic must go through Cloudflare (good for sites already using CF acceleration)

6. The 3 Real Reasons You Should Install HTTPS (Not "Google Likes It")

Many articles online tell you "install HTTPS because Google likes it". This is actually the weakest reason. The real reasons you must install it are these 3:

Reason 1: Visitors Will Bounce

Chrome now shows "Not Secure" for all HTTP sites. Imagine you open an e-commerce site ready to order, and the address bar says "Not Secure" — would you hesitate?

Real data: HTTPS sites have an average conversion rate 5-15% higher than HTTP sites (source: HubSpot, 2024). This is a user psychology issue, not an SEO ranking issue.

Reason 2: Browser Features Will Be Limited

Many modern browser features are only available to HTTPS sites:

• Geolocation API
• Camera/microphone access (getUserMedia)
• Service Worker (PWA offline)
• Web Push notifications
• HTTP/2 (30-50% performance improvement)

Without HTTPS, none of these features work.

Reason 3: SEO Is Directly Affected

Google has listed HTTPS as a search ranking factor since 2014. Moz's 2023 statistics show HTTP sites' share of the top 3 search results dropped from 25% in 2018 to 3% in 2023.

Not because HTTPS is magical, but because: sites that can install HTTPS usually have better basic maintenance (SSL certs themselves need regular renewal, reflecting operational attitude). Google uses it as a quality signal.

7. 5 Things to Know Before Installing HTTPS

1. Certificates aren't install-and-forget — they need renewal — Let's Encrypt / ZeroSSL are both 90 days, either write your own auto-renewal script or use official tools. I once forgot to renew, cert expired for 12 hours, the site was completely down.
2. The domain in the cert must match the domain you visit — if the cert is for www.baccpc.com but you visit baccpc.com (no www), you'll get an error. Free certs only sign single domains, so either sign two, or use Wildcard (expensive).
3. Installing HTTPS won't immediately boost SEO rankings — it's a necessary condition, not a sufficient one. My own install in June: ranking changes came mainly from content quality, not the cert.
4. Mobile browsers have zero tolerance for self-signed certs — iOS Safari shows a red warning screen, users can't possibly click "continue". You must use a cert signed by a real CA.
5. Remember 301 redirects after installing HTTPS — HTTP versions should 301 to HTTPS, otherwise search engines will index both versions, diluting your ranking power.

FAQ