What is TLS and what does the HTTPS padlock really protect?

Published on 2026-10-20 by frfrand

TLS explicado sin misterio: cómo HTTPS protege datos en tránsito, certificados, claves, autenticación y qué significa —y qué no— el candado del navegador.

TLS is a protocol that helps protect communication between two systems through encryption, authentication, and integrity controls. It is one of the technologies that allows the browser to connect to a website via HTTPS without sending passwords and sensitive data directly as plain text readable by anyone observing the traffic.

But having HTTPS does not mean that a page is honest or that the application is invulnerable. That difference is fundamental.

The example of the sealed letter

Imagine you are sending an important letter. If you send it open, several people along the way could read it. If you protect it in a sealed envelope and correctly verify who it is addressed to, you reduce some risks.

TLS uses cryptographic mechanisms much more complex than an envelope, but the goal of confidentiality and integrity is comparable: making it difficult for third parties to read or modify the information while it travels.

Encryption protects data in transit. If the server has an exposed database, a stolen password, or a problem in its application, HTTPS does not fix those failures.

Are HTTPS and TLS the same?

Not exactly. HTTPS is HTTP transported over a protected connection, normally TLS. HTTP defines how web requests and responses are made. TLS helps secure the channel through which they circulate.

That is why connections to https:// indicate a secure transport method to the server, not a general evaluation of the page quality.

What is a certificate for?

When a browser connects to a domain, it must verify that it is communicating with the correct server. A digital certificate allows linking information about an identity—such as a domain name—with a public key, following the trust system used by the browser.

Certification authorities issue certificates after performing checks. The browser validates the chain of trust, the domain, and other relevant conditions.

A certificate valid for ejemplo.com does not imply that all its products, forms, or employees are trustworthy. It certifies properties of the connection and the represented identity, not the owner's intentions.

What happens when you open an HTTPS website?

In general terms, the browser and server negotiate secure parameters, use cryptography to establish session secrets, and then exchange protected information.

Modern versions of TLS are designed to avoid many problems of old protocols. Maintaining secure versions and configurations is the responsibility of the server and the components that terminate the connection.

You don't need to memorize all the messages in the exchange to understand the consequence: information should not circulate in clear text over the network in the same way it would through an unprotected HTTP connection.

Where does encryption end?

This question is especially important when you use a load balancer or proxy. TLS can terminate at the proxy and the connection to the backend can use another protected connection or an internal network with a different design.

Real security depends on the entire path. It is not enough to see a padlock in the browser if you then send credentials over an internal network that is not adequately protected.

What does the browser padlock mean?

In practical terms, the browser indicates that it is using a secure connection according to its checks. It does not guarantee that the page is not a scam.

A phishing website can obtain a valid TLS certificate and display HTTPS. Always check the domain, especially when you receive unexpected links asking you to log in or make a payment.

When should I renew a certificate?

Certificates have a validity period. If they expire, browsers may display warnings and make normal access to the site difficult.

Tools like Certbot and automated certificate services facilitate issuance and renewal, but it is advisable to monitor dates, DNS, and errors. An automatic renewal that fails silently can become a public outage.

TLS doesn't replace everything else

Keep using parameterized queries, appropriate permissions, updates, backups, and account protection. Transport confidentiality does not prevent an application from delivering information to a user who should not have access.

How does it apply in ArduMaker?

When publishing web applications from managed VPS in ArduMaker, the domain, proxy, and destination service must have a correct HTTPS design. A certificate protects the connection at the point where it is used; it does not replace backend security.

In one sentence: TLS protects the conversation between systems, but does not certify that everything happening inside them is secure.

Sources: TLS 1.3 Specification · MDN Introduction to TLS · Publish an HTTPS domain in ArduMaker.