👤 Your account

🔐 How HTTPS actually works

The padlock is not magic — it is a short conversation between your browser and the website. Tap each step to see what really happens.

The certificate chain of trust

Your browser does not trust a random website's word for it. It trusts a chain:

🌐 Leaf certificateIssued to the website's domain (e.g. example.com). Proves the server controls that domain and holds the matching private key.

🔗 Intermediate CASigned the leaf certificate. Certificate Authorities delegate through intermediates so the root key can stay locked away offline.

🏛 Root CASelf-signed and pre-installed in your browser/OS trust store. If the chain leads here and every signature checks out, the connection is trusted.

Anatomy of a certificate

Field	What it tells you
Subject / SAN	The domain names the certificate is valid for. A mismatch = browser warning.
Issuer	Which CA issued it (e.g. Let's Encrypt, DigiCert, Sectigo).
Validity period	Issue and expiry dates. Modern certs last at most ~398 days; browsers warn on expired certs.
Public key	Used during the TLS handshake to agree on a one-time session key.
Fingerprint	A hash of the whole certificate — its unique ID.

🧠 Myth-busting: what the padlock does NOT mean

Tap each statement to reveal whether it is true or false.

Types of certificates

Type	What is checked	Padlock?
DV — Domain Validation	Only that the applicant controls the domain. Free and automated (e.g. Let's Encrypt).	Yes
OV — Organization Validation	Domain control + the organisation legally exists.	Yes
EV — Extended Validation	Domain + organisation, verified to a strict standard. Historically showed the company name in the address bar.	Yes

All three encrypt equally well. The difference is how much identity checking happened — and none of them check whether the site is honest.

🔎 Guided check: inspect a real website

Open any website in a new tab, click its padlock / tune icon, and answer what you see. This teaches the exact habit security professionals use.

Is there a padlock and does the page load over https://? Does the certificate's domain exactly match the address bar? Is the site asking for passwords, cards or codes?

🗂 My Site Observations

Keep a log of websites you inspected: what the certificate showed and your verdict. Records are saved under your local account (or guest space) on this device — create, view, edit and delete them any time.

SSL Certificate & HTTPS Guide