HTTPS and TLS Certificates: What They Actually Guarantee

The browser padlock icon created a myth: padlock = safe. Security trainers have been trying to undo this for a decade. Here's what the padlock actually tells you.

What HTTPS Guarantees

Two things, precisely.

First: your connection to the server is encrypted. Data in transit can't be read by eavesdroppers — your ISP, someone on the same Wi-Fi, a network device in between. This is the meaningful protection most people intuitively understand.

Second: the certificate was issued to the domain you're connecting to by a certificate authority your browser trusts. This means the server is very likely the legitimate operator of that domain.

What HTTPS Does Not Guarantee

Whether the site is trustworthy. Whether it's a phishing site. Whether your data will be safely stored after it arrives. Whether the site owner is who they say they are.

In 2024, over 80% of phishing sites use HTTPS. Getting a certificate is free and takes minutes with Let's Encrypt. Attackers register legitimate-looking domains, set up HTTPS, and run convincing phishing sites.

Extended Validation vs Domain Validated Certificates

Domain Validated (DV) certificates — which is what most sites use — only verify domain ownership. No identity verification beyond 'this person controls the DNS of this domain.' Extended Validation (EV) certificates required rigorous identity verification of the organization. Browser vendors removed prominent EV certificate display in 2019 because research showed users didn't use it to make security decisions. Most sites use DV certificates today, including major banks and financial institutions.

Certificate Expiration: Why Sites Break

HTTPS certificates expire — usually after 90 days (Let's Encrypt) or 1 year (commercial certificates). When a certificate expires and isn't renewed, browsers show a scary warning page and many users can't proceed. This is intentional — it's better to show a warning than silently allow an expired certificate that might indicate an abandoned or compromised site. If you run a site, set up automatic certificate renewal. If you see an expired certificate warning on a site you trust, contact the site administrator — their auto-renewal probably failed.