The browser padlock looks simple, but DNS, certificates, cryptography and network protocols work together behind it. Understanding what SSL, TLS, HTTPS and HTTP/3 each do helps with outages, migrations and security decisions. It also prevents the assumption that a certificate makes an entire website secure.

SSL is the old name; TLS is the current protocol

People often say SSL certificate, but modern browsers use TLS. TLS 1.3 is current, while TLS 1.2 remains for compatibility. Old SSL versions and TLS 1.0/1.1 should no longer be enabled. TLS protects traffic from interception and alteration and uses the certificate to authenticate the server to which the browser connects.

What happens during a TLS handshake?

1. The browser connects to the IP address for the domain.
2. Browser and server negotiate a protocol version and cryptographic capabilities.
3. The server provides its certificate and certificate chain.
4. The browser validates the hostname, validity period, signatures and trusted issuer.
5. Both sides derive session keys and then encrypt the HTTP traffic.

TLS 1.3 needs fewer steps than older configurations. A valid chain, modern cipher suites and efficient session resumption reduce avoidable delay.

HTTPS is HTTP inside TLS

HTTPS protects the connection, not the website’s code or content. A compromised site can still hold a valid certificate. Updates, account isolation, malware detection, strong credentials and application security remain necessary. HTTPS primarily prevents third parties from silently reading or changing data in transit.

What does a certificate prove?

A Domain Validation certificate proves that the requester controlled the domain at issuance. It is not a quality label for the organisation. When diagnosing a problem, check:

• whether the exact hostname appears as a SAN;
• whether the server supplies the complete intermediate chain;
• whether the certificate and private key match;
• whether automatic renewal works and is monitored;
• whether IPv4 and IPv6 lead to servers presenting the same valid certificate.

HSTS and mixed content

The HSTS header tells a browser to use HTTPS only. This prevents a future unencrypted first attempt, but use a long max-age, includeSubDomains or preload only after every subdomain reliably supports HTTPS. Visitors cannot easily bypass a broken HSTS deployment.

Mixed content occurs when an HTTPS page requests scripts, stylesheets or images over HTTP. Browsers block active content or display warnings. Update internal URLs and inspect the theme, database, CDN and external integrations.

HTTP/2 and HTTP/3: faster transport, same application

HTTP/3 uses QUIC over UDP and is secure by default. Unlike HTTP/2 over TCP, QUIC can reduce connection delay and the effect of head-of-line blocking under packet loss. This is particularly useful on mobile or unstable networks. Browser and server negotiate automatically, usually falling back to HTTP/2 when HTTP/3 is unavailable.

HTTP/3 cannot repair a slow database or oversized image. It improves transport, while LiteSpeed caching, Redis, image optimisation and efficient application code address the other layers.

A practical checklist

1. Use one clean redirect from HTTP to HTTPS.
2. Support TLS 1.3 and, where required, TLS 1.2; disable obsolete protocols.
3. Validate the chain, hostnames, expiry and automatic renewal.
4. Remove mixed content and insecure forms.
5. Introduce HSTS carefully, beginning with a short test period.
6. Enable HTTP/2 and HTTP/3 and check UDP/443 and the Alt-Svc advertisement.
7. After DNS, CDN or server changes, monitor both IPv4 and IPv6.

Frequently asked questions

Is a free certificate less secure?

Not in transport encryption when validation, key and configuration are correct. Differences mainly concern validation type, service, warranty and management.

Why is the word “SSL” still used?

It remains common in product names and control panels. The modern technical connection uses TLS.

Does every site need HTTP/3?

Modern support is useful and has a safe fallback, but measure the effect. Hosting and application performance matter more than the protocol alone.

Would you like modern encryption and fast protocols configured properly? Explore our hosting solutions or ask Gigatech to review your setup.

Sources: MDN TLS documentation and HTTP/3 documentation.