Learn IT Fundamentals with Teacher PochiWhat is a communication protocol?
A protocol is a shared set of rules (a kind of etiquette) that devices use to exchange information. HTTP (HyperText Transfer Protocol) is the common rule set that browsers and servers use to exchange information — it's the Web's basic protocol.
The "request"/"response" exchange between client and server, and methods like GET and POST, are all defined within this same set of HTTP rules.
Teacher Pochi's hintA protocol is like a shared language for a conversation. Because both sides follow the same rules, what you mean to say actually gets across.
The difference between HTTP and HTTPS
The "http" or "https" at the start of a URL tells you which rule set is being used to communicate. The difference between the two comes down to whether the content is encrypted.
https://Protocolhassan-learning-portal.comDomain/en/topics/web-fundamentals/protocol.htmlPath(postcard)
(locked envelope)
Teacher Pochi's hintHTTP is like a "postcard," and HTTPS is like a "locked envelope." Anyone handling a postcard along the way can read its contents, but with a locked envelope, only the intended recipient can see what's inside.
Implement with HTTPS by default
It used to be common to only enable HTTPS on pages handling personal information, like a login page. Today, the standard practice is to implement an entire website with HTTPS.
Teacher Pochi's hintIt used to feel like "only use a locked box for valuables." Now it's more like "send every package in a locked box" — that's just the default.
What is a server certificate?
A server certificate is proof that a web server's operator is exactly who they claim to be — an ID card for the internet. It records the domain name, expiration date, issuer information, and the "public key" we'll cover in the next slide.
the certificate
checks it
Teacher Pochi's hintIt's like showing an ID card when you pick up a delivery or check in at a counter. Having the certificate is what lets the other side confirm, "yes, this is definitely them."
What is public key authentication?
Public key authentication is an encryption method that uses two keys that come as a pair: a "public key" and a "private key." The public key can be handed out to anyone, but data encrypted with it can only be decrypted with its matching private key.
with the public key
data
with the private key
Teacher Pochi's hintThink of a padlock. The public key is like an open padlock anyone can use to lock a package. Send the package locked like that, and only whoever holds the matching key (the private key) can open it.
What is a private key?
A private key is the counterpart to a public key, held only by the server's operator. Having this private key is exactly what lets the server decrypt data encrypted with the public key, proving "this server really is the certificate's rightful owner."
If a private key were ever leaked, someone else could impersonate the server, so the certificate would need to be revoked and reissued with a brand-new key pair.
Teacher Pochi's hintIt's like a spare house key. Lose it, or hand it to the wrong person, and now anyone can get inside. That's exactly why a private key has to be guarded carefully and never handed over.
Certificate authorities (CAs)
Not just anyone can issue a server certificate. A trusted third party called a "certificate authority" (CA) verifies the operator's identity before issuing one. Browsers keep a pre-installed list of trusted CAs, and they only treat a certificate as trustworthy if it was issued by a CA on that list.
authority (CA)
the certificate
On every connection, the browser automatically checks whether the domain name matches the certificate, whether it's still within its validity period, and whether it was issued by a trusted CA — only when all three hold does the address bar show a lock icon.
Teacher Pochi's hintA CA is like a government agency. If anyone could freely issue an ID card, it wouldn't mean anything — it's precisely because a trusted authority issues it that other people can rely on it.
Certificate chains
In practice, the "root CA" a browser directly trusts almost never signs an end server's certificate itself. Instead, trust is usually chained through several steps — root CA → intermediate CA → server certificate — and this chain of signatures is called a "certificate chain."
CA
CA
certificate
If any single link in this chain is missing, or has expired, the browser will show a warning screen.
Teacher Pochi's hintThink of a chain of introductions. You don't know someone directly, but a friend you trust (the root CA) introduces an acquaintance (the intermediate CA), who in turn introduces someone else (the server) — and that gives you indirect trust in them.