{"id":2230,"date":"2026-08-15T09:00:00","date_gmt":"2026-08-15T09:00:00","guid":{"rendered":"https:\/\/gigatech.nl\/?p=2230"},"modified":"2026-08-15T09:00:00","modified_gmt":"2026-08-15T09:00:00","slug":"ssl-tls-https-http3-explained","status":"publish","type":"post","link":"https:\/\/gigatech.nl\/en\/ssl-tls-https-http3-explained\/","title":{"rendered":"SSL, TLS, HTTPS and HTTP\/3: How a Secure Connection Works"},"content":{"rendered":"
\"Protected<\/figure>\n

The browser padlock looks simple, but DNS, certificates, cryptography and network protocols work together behind it. Understanding what SSL, TLS, HTTPS and HTTP\/3<\/strong> each do helps with outages, migrations and security decisions. It also prevents the assumption that a certificate makes an entire website secure.<\/p>\n

SSL is the old name; TLS is the current protocol<\/h2>\n

People often say SSL certificate, but modern browsers use TLS. TLS 1.3 is current, while TLS 1.2 remains for compatibility. Old SSL versions and TLS 1.0\/1.1 should no longer be enabled. TLS protects traffic from interception and alteration and uses the certificate to authenticate the server to which the browser connects.<\/p>\n

What happens during a TLS handshake?<\/h2>\n
    \n
  1. The browser connects to the IP address for the domain.<\/li>\n
  2. Browser and server negotiate a protocol version and cryptographic capabilities.<\/li>\n
  3. The server provides its certificate and certificate chain.<\/li>\n
  4. The browser validates the hostname, validity period, signatures and trusted issuer.<\/li>\n
  5. Both sides derive session keys and then encrypt the HTTP traffic.<\/li>\n<\/ol>\n

    TLS 1.3 needs fewer steps than older configurations. A valid chain, modern cipher suites and efficient session resumption reduce avoidable delay.<\/p>\n

    HTTPS is HTTP inside TLS<\/h2>\n

    HTTPS protects the connection, not the website\u2019s code or content. A compromised site can still hold a valid certificate. Updates, account isolation, malware detection, strong credentials and application security remain necessary. HTTPS primarily prevents third parties from silently reading or changing data in transit.<\/p>\n

    What does a certificate prove?<\/h2>\n

    A Domain Validation certificate proves that the requester controlled the domain at issuance. It is not a quality label for the organisation. When diagnosing a problem, check:<\/p>\n