OWASP TLS and HTTPS

Data travels through many networks before it reaches a server: home routers, public Wi-Fi, internet providers, and more. Transport Layer Security, or TLS, wraps that data in an encrypted tunnel. HTTPS means HTTP carried inside TLS, and the padlock in the browser signals that the tunnel exists.

The Sealed Envelope Comparison

Sending a postcard lets every postal worker read the message. Sending a sealed, tamper-evident envelope hides the message and reveals any opening attempt. HTTP behaves like the postcard, and HTTPS behaves like the sealed envelope.

What TLS Provides

The Handshake in Simple Steps

 Browser                                   Server
    |  1. Hello, I support these ciphers →    |
    |  ← 2. Hello, use this one + certificate |
    |  3. Check certificate against trusted   |
    |     authorities                         |
    |  4. Agree on shared session keys    ⇄   |
    |  5. Encrypted data flows both ways  ⇄   |

The handshake happens in milliseconds. Modern TLS 1.3 shortens it further and removes older weak options.

Certificates Explained

A certificate links a domain name to a public key. A trusted certificate authority signs it after verifying that the requester controls the domain. Browsers carry a list of trusted authorities and reject certificates that fail checks.

Certificate Problems Browsers Flag

• Expired certificate.
• Name mismatch between the certificate and the site address.
• Untrusted or self-signed issuer.
• Revoked certificate.

Version Guide

Common Weaknesses

• Mixed content: A secure page loads scripts or images over plain HTTP, and attackers modify those resources.
• Downgrade attacks: Attackers push a connection toward an older, weaker version.
• Missing redirects: Visitors who type the address without HTTPS land on the insecure version first.
• Ignored certificate errors: Application code that disables certificate checks removes the whole benefit of TLS.

Server Configuration Checklist

1. Install a certificate from a trusted authority and automate renewal.
2. Redirect all HTTP requests to HTTPS.
3. Enable TLS 1.2 and TLS 1.3 only.
4. Select strong cipher suites with forward secrecy.
5. Send the Strict-Transport-Security header.
6. Mark session cookies with the Secure flag.
7. Test the site with a public TLS scanner and fix the findings.

Beyond the Browser

Internal service calls, database connections, and mobile apps need TLS too. Attackers who reach an internal network read plain traffic easily. Mobile apps must validate certificates and avoid code that trusts every certificate.

Forward Secrecy in Plain Words

Forward secrecy creates a fresh temporary key for every connection. An attacker who records encrypted traffic today and steals the server's long-term key next year still cannot read the old recordings. Every TLS 1.3 connection includes forward secrecy, and TLS 1.2 offers it through specific cipher suites that administrators should select.

Testing Your Own Setup

Public scanners connect to your site and report the supported protocol versions, certificate dates, and cipher suites. Scan after every server change and schedule a monthly review. Set reminders for certificate expiry even when automation exists, because silent renewal failures cause surprise outages.

Key Takeaways

• HTTPS equals HTTP plus TLS.
• TLS delivers privacy, integrity, and server identity.
• Old protocol versions must stay off.
• Automated renewal and HSTS keep the setup healthy over time.