SSL/TLS

SSL/TLS is the layer that makes https:// real: the browser and server agree on a session key so traffic between them cannot be read by a third party. The certificate is the visible part, but the work happens in the quiet key negotiation. Classic SSL is obsolete, what runs today is TLS, even though panels still print "SSL".

What the handshake settles

When a connection opens, browser and server perform a short handshake. They pick a TLS version and a cipher suite, the server presents its certificate, and both sides derive a session key. The private key is never sent to the browser. It stays on the server and is used only to prove the certificate belongs there. The handshake happens once per session, and that shared key is what keeps form fields, logins, and payments private. Old versions such as TLS 1.0 and 1.1 are considered weak and should be disabled.

The certificate chain and a missing intermediate

A trusted certificate rarely stands alone. It hangs on a chain: your certificate, one or more intermediates issued by the CA, and a root the browser already knows. If an intermediate is skipped during install, some clients still load the site because they cached a copy, while others fail with a certificate warning. That is the classic "it only errors on some devices." The fix is to install the full chain, including free certs from Let's Encrypt, not just the leaf certificate.

Checking it by hand

openssl s_client -connect example.com:443 -servername example.com

This shows the chain the server actually sends, so you can see whether the intermediate is present. If the output reports a verify error or a truncated chain, the problem is a missing intermediate. To force a client to rebuild the chain, clear its cache and test across a couple of devices or networks.

A valid certificate proves little about content

Identity matters, but it is not a full guarantee. A certificate proves this key belongs to that hostname, not that the content is honest or safe. If a page still loads images or scripts over http://, the browser shows a mixed-content warning even on an encrypted connection, because those assets can be tampered with. A HTTP to HTTPS redirect closes part of the gap, and HSTS forces the browser to use HTTPS only. Cover many subdomains with Wildcard SSL, and if the site sits behind Cloudflare make sure the origin SSL mode is correct. DNS records such as CAA also limit who can issue.

FAQ