HTTPS and TLS

1. What It Is

HTTPS is HTTP transmitted over a TLS (Transport Layer Security) encrypted connection. TLS is the cryptographic protocol that provides three things:

1. Encryption — data in transit is unreadable to anyone intercepting the connection
2. Authentication — the client can verify it's talking to the real server (not an impersonator)
3. Integrity — data cannot be tampered with in transit without detection

The problem it solves: Plain HTTP sends everything as readable text. Anyone on the network path — a coffee shop Wi-Fi router, an ISP, a network device — can read passwords, tokens, personal data, and inject content into responses. HTTPS makes this infeasible.

Why a backend engineer should care: Handling TLS termination, certificate management, and understanding what HTTPS does and doesn't protect is part of everyday backend and infrastructure work. Misconfigured TLS is a serious security vulnerability, and certificate expiry is one of the most common causes of production outages.