What the padlock actually promises

Everything so far travels in plain text, readable and modifiable by anyone on the path. TLS provides three things, and it is worth being precise about which.

The three guarantees

Confidentiality: nobody on the path can read it. Integrity: nobody can modify it without detection. Authentication: you are talking to who you think.

The third is the one people underestimate. Encryption without authentication protects you perfectly while you talk to an attacker.

The handshake

client -> server:  hello, here are the ciphers I support
server -> client:  hello, this cipher, and here is my certificate
client:            validate the certificate against trusted roots
both:              agree a shared secret without sending it
both:              switch to symmetric encryption

Asymmetric cryptography is slow, so it is used only to agree a key. Everything after is symmetric, which is fast. Using the expensive operation once to bootstrap the cheap one is the core design.

TLS 1.3 removed the older options, cut the handshake to one round trip, and made forward secrecy mandatory: a fresh key per session, so recording the traffic today and stealing the server's key next year does not decrypt it.

Certificates

A certificate binds a name to a public key, signed by a certificate authority your device already trusts.

subject:  CN=example.com
issuer:   CN=Some CA
valid:    2026-01-01 to 2027-01-01
key:      (public key)
signature: (signed by the CA)

The chain matters: the server's certificate is signed by an intermediate, which is signed by a root in your device's trust store. Forgetting to serve the intermediate is one of the most common configuration errors, and it produces the confusing symptom of working in one browser and failing in another, depending on whether that client already cached the intermediate.

What it does not protect

The destination. Which site you visited is visible from the DNS query and the server name sent in the handshake. The content is hidden; the fact of the conversation is not.

Traffic size and timing. Enough to infer a good deal.

The endpoints. A compromised server encrypts faithfully to whoever asks.

Anything about trustworthiness. A padlock means the connection is private, not that the site is honest. Phishing sites have valid certificates, because certificates are free and prove control of a domain rather than good intent. Teaching people to "look for the padlock" was advice that outlived its usefulness.