HTTPS and TLS

What TLS actually protects, how certificates get validated, renewal automation, and mixed content traps.

What HTTPS gives you

Note what it does not do: HTTPS does not make a site trustworthy, and it encrypts only the transport — the server still sees everything once decrypted.

Certificate chains

A browser trusts a certificate because it chains to a root already in its trust store. You normally install a leaf certificate plus any intermediate certificates — a missing intermediate is the most common 'works in some browsers' failure.

openssl s_client -connect example.com:443 -servername example.com

echo | openssl s_client -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer

• Domain-validated (DV) certificates are free and automated — enough for most sites.
• Wildcard certs cover *.example.com but never the bare domain; include both.
• Certificate transparency logs are public — treat certificate issuance as observable globally.

Renewal without drama

# Let's Encrypt with Certbot
certbot certonly --webroot -w /var/www/app -d example.com -d www.example.com
certbot renew --dry-run

# certificates typically last 90 days; automate renewal
systemctl list-timers | grep certbot

Mixed content

Loading any subresource over http:// in an https:// page weakens the guarantee. Modern browsers silently upgrade images but block scripts and styles — showing 'unexpected behaviour' rather than an obvious error.

<!-- do not hardcode the scheme -->
<script src='//cdn.example/lib.js'></script>

<!-- better: same-origin, scheme-relative as fallback -->
<script src='/vendor/lib.js'></script>

Add Content-Security-Policy: upgrade-insecure-requests to rewrite accidental http URLs automatically, and always send HSTS once you are confident.

FAQ

Related

HTTP headers Hash functions: MD5, SHA-1, SHA-256

Last refreshed 2026-09-17.