Web & certificates

What is HTTPS & TLS? Website encryption explained

HTTPS encrypts the connection between browser and website using TLS. It needs a valid certificate, current TLS versions and a redirect from HTTP to HTTPS.

How HTTPS & TLS works

When the connection is set up, the server presents a certificate. It must come from a trusted certificate authority, be issued for the requested host name (including www, if used) and still be valid.

Current versions are TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 have been deprecated since RFC 8996 (2021) and should be switched off. Free certificates such as those from Let's Encrypt have short lifetimes and must be renewed automatically.

Anyone opening the site via http:// should be redirected permanently (301 or 308) to https://. HSTS then makes sure the browser does not even try an unencrypted request.

Example

# nginx
ssl_protocols TLSv1.2 TLSv1.3;

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

Only TLS 1.2 and 1.3 are allowed; HTTP redirects permanently to HTTPS.

Common mistakes

The certificate does not cover www, or www is not reachable via HTTPS at all.
Automatic renewal has failed and the certificate expires.
A temporary redirect (302) instead of a permanent one (301/308) from HTTP to HTTPS.
TLS 1.0/1.1 is still enabled for compatibility.

How the Domain Trust Check rates HTTPS & TLS

Criterion “HTTPS main domain” (weight 5 of 5): Reachable via HTTPS, trusted and matching certificate, remaining validity, TLS 1.2/1.3 instead of TLS 1.0/1.1, permanent HTTP→HTTPS redirect and HSTS.

Criterion “HTTPS www” (weight 5 of 5): The same checks for the www subdomain. If there is no www subdomain, the criterion is not applicable.

Standard: RFC 8446 (TLS 1.3), RFC 8996