HTTPS | Learn IT Fundamentals with Teacher Pochi

Key points

HTTPS doesn't just encrypt communication — it also uses "certificates" to guarantee that the destination is genuine.
Certificates are issued by a trusted third party called a "certificate authority (CA)," and browsers judge safety based on that chain of trust.
Issues like an expired certificate connect directly to infrastructure operations trouble, making this an important element to understand.

What HTTPS protects

HTTPS doesn't just encrypt communication to prevent eavesdropping — it also plays a role in confirming "whether the server you're accessing right now is really who you intended to reach."

🔒 EncryptionKeeps the content of communication unreadable to third parties

📜 Identity verificationGuarantees the destination is a genuine server

We cover the detailed mechanics of encryption itself in the HTTPS topic under Web Fundamentals. Here, we'll focus on the "infrastructure" side — how certificates are issued and verified.

What is an SSL/TLS certificate?

An SSL/TLS certificate proves that a web server's operator is "undeniably who they claim to be" — essentially an ID card for the internet. A certificate records information such as the domain name, expiration date, and issuer.

Server holds
the certificate

Presented on connection

Browser
verifies it

🔑 Everyday exampleIt's similar to the ID card you present when accepting a delivery or verifying your identity at a counter. Having the certificate lets the other party confirm "this is undeniably who they claim to be."

Certificate authorities (CAs) and the chain of trust

Not just anyone can freely issue a certificate — a trusted third party called a "certificate authority (CA)" issues one only after review. Browsers keep a pre-built list of trusted certificate authorities, and they judge a certificate as "trustworthy" only if it was issued by a CA on that list.

Certificate
authority (CA)

Reviews and issues

Server holds
the certificate

Presented on connection

Browser confirms
trust

🔑 Everyday exampleA certificate authority is like a government agency. There would be no point in an ID card if anyone could freely issue one — it's precisely because a trusted authority issues it that other people can trust it.

How browsers verify certificates

Every time it connects, the browser automatically checks points like the following.

✅ What gets checked Does the domain name match the certificate? Is it within its validity period? Was it issued by a trusted certificate authority?

Only when all of these conditions are met does the lock icon appear in the browser's address bar.

Certificate trouble

If there's a problem with a certificate, the browser displays a warning screen and blocks the connection. In services running in production, the following kinds of trouble are typical.

NormalThe lock icon appears and you connect without any warning

Expired certificateForgetting to renew triggers a warning screen

Self-signed certificateA certificate created without going through a CA isn't trusted

🔑 Everyday exampleAn expired certificate is similar to an expired passport. Even though the person inside hasn't changed, once it's expired, it won't be accepted as "official proof of identity."

Summary

From an infrastructure perspective, HTTPS is a mechanism that, in addition to encryption, "guarantees the destination is genuine through a certificate issued by a certificate authority." Managing a certificate's expiration date and issuer is one of the important tasks in infrastructure operations.