Amr Samir | How HTTPS & TLS 1.3 Work Under the Hood

1. What Really Happens Behind the Green Padlock

HTTPS is HTTP layered over Transport Layer Security (TLS). It provides three essential guarantees:

Confidentiality (Encryption): Prevents eavesdroppers from reading transmitted packets.

Integrity: Detects any alteration or tampering of data in transit.

Authentication: Proves the client is communicating with the genuine server, not an impostor.

code

+-------------------------------------------------------+
|                   Application (HTTP)                  |
+-------------------------------------------------------+
|             TLS Layer (Encryption & Integrity)        |
+-------------------------------------------------------+
|                    TCP Transport                      |
+-------------------------------------------------------+
|                     IP Network                        |
+-------------------------------------------------------+

2. The TLS 1.3 Handshake (1-RTT)

code

+--------+                                                 +--------+
| Client | --- 1. ClientHello (Cipher Suites + Key Share)->| Server |
|        |                                                 |        |
|        | <--- 2. ServerHello (Key Share + Certificate) --|        |
|        |         + EncryptedExtensions + Finished        |        |
|        |                                                 |        |
|        | [ Derive Symmetric AES-GCM Session Key ]       |        |
|        |                                                 |        |
|        | === 3. Encrypted Application Data (HTTP/2) ===> |        |
|        | <== 4. Encrypted Application Data (HTTP/2) ==== |        |
+--------+                                                 +--------+

3. Asymmetric vs Symmetric Encryption Roles

Asymmetric Encryption (ECDHE / RSA): Computationally heavy; used exclusively during the initial handshake to authenticate server certificates and securely agree upon a shared secret.

Symmetric Encryption (AES-GCM / ChaCha20-Poly1305): Extremely fast with hardware CPU acceleration; used to encrypt all actual application traffic using the agreed session key.

4. Public Key Infrastructure (PKI) & Certificate Authorities (CA)

How does your browser verify that google.com belongs to Google?

The server presents a certificate signed by an intermediate CA.

The browser walks up the certificate chain to a pre-installed Root Certificate Authority in the OS trust store.

If any signature in the chain is invalid or expired, the browser blocks the connection with a security alert.

HTTPS & TLS Behind the Lock: Asymmetric Handshakes, Symmetric Ciphers & PKI

Recommended Posts

Designing Secure Password Reset & OTP Verification: Timing Attacks, Rate Limits & State

JWT Authentication in Production: Access Tokens, Refresh Token Rotation & Revocation

CORS Deep Dive: Why the Browser Sends Preflight OPTIONS and How to Fix It

HTTPS & TLS Behind the Lock: Asymmetric Handshakes, Symmetric Ciphers & PKI

1. What Really Happens Behind the Green Padlock

2. The TLS 1.3 Handshake (1-RTT)

3. Asymmetric vs Symmetric Encryption Roles

4. Public Key Infrastructure (PKI) & Certificate Authorities (CA)

5. Summary