SSL (Secure Socket Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that provide secure communication over a computer network. They encrypt data between a web browser and server, ensuring privacy, integrity, and authentication.
SSL/TLS uses a combination of asymmetric encryption (public/private key pairs) for key exchange and symmetric encryption for data transfer. When you visit an HTTPS website, the server presents a digital certificate signed by a Certificate Authority (CA) to prove its identity. After verification, both parties agree on session keys for encrypted communication.
The TLS handshake begins when a client connects to an HTTPS server. The server sends its certificate containing its public key. The client verifies the certificate against trusted CAs, generates a premaster secret, encrypts it with the server's public key, and sends it. Both sides derive session keys and switch to symmetric encryption for the remainder of the session.
TLS is the successor to SSL. SSL 3.0 was deprecated in 2015 due to vulnerabilities (POODLE attack). TLS 1.2 and TLS 1.3 are the current secure protocols. People still say SSL but mean TLS.
Yes. Google and all major browsers mark HTTP sites as Not Secure. HTTPS is required for SEO rankings, browser features, and user trust. Let's Encrypt provides free certificates.
A self-signed certificate is not signed by a trusted CA. Browsers show a warning for self-signed certificates. They are suitable for development but not production use.