HTTPS and TLS: What the Padlock Actually Means
HTTPS 和 TLS：地址栏小锁的真正含义
That little padlock in your browser address bar is one of the most misunderstood icons in computing. People see it and assume the site is "safe". It is not. The padlock means one specific thing: the connection between your browser and the server is encrypted and that the server has proven control over a domain name via a trusted certificate. It says nothing about whether the site is honest, whether it will respect your data, or whether it is run by people you should trust. Understanding what TLS does and what it does not do is the foundation of practical web security.
浏览器地址栏里的小锁，是计算领域最容易被误解的图标之一。人们看到它就以为"这个网站是安全的"。其实不是。小锁只表示一件具体的事：你和服务器之间的连接是加密的，并且服务器通过一张受信证书证明了自己对域名的控制权。它并不能说明这个网站是否诚实、是否会尊重你的数据，更不代表运营者值得信任。弄清 TLS 做了什么、没做什么，是理解 Web 安全的基础。
From HTTP to HTTPS: why plaintext was a problem
从 HTTP 到 HTTPS：明文为什么是问题
HTTP, the original protocol of the web, sends every byte — URLs, headers, cookies, form data, the page content itself — as plaintext across the network. Anyone between you and the server can read or modify it. In the early days, that mostly meant curious coworkers on the office Ethernet. Today it means anyone on the same coffee-shop Wi-Fi, any router along the path, any ISP or transit provider, and any government with a tap on a backbone. Plaintext HTTP is a postcard. HTTPS is a sealed envelope that only the recipient can open.
HTTP 是 Web 的原始协议，它把每一个字节 —— URL、请求头、Cookie、表单数据、页面内容 —— 都以明文形式在网络上发送。你和服务器之间的任何人都可以读取或修改。早些年这通常只是办公室以太网里好奇的同事；如今它意味着任何同咖啡馆 Wi-Fi 的人、路径上任何一台路由器、任何 ISP 或骨干网运营商，以及任何在骨干网上有节点的政府。HTTP 明文就像一张明信片；HTTPS 则是一封只有收件人才能拆开的密封信封。
The fix is TLS — Transport Layer Security, the modern successor to SSL. When you see HTTPS, you are really seeing HTTP running on top of a TLS-encrypted tunnel. The browser opens a TLS connection to port 443 of the server, performs a short handshake to agree on keys and verify identity, and only then starts sending HTTP traffic through that tunnel. From the outside, an observer sees a stream of encrypted bytes; inside, both sides see ordinary HTTP requests and responses.
解决方案是 TLS —— 即传输层安全（Transport Layer Security），是 SSL 的现代继承者。看到 HTTPS 时，你其实看到的是 HTTP 跑在一条 TLS 加密隧道之上。浏览器和服务器的 443 端口建立 TLS 连接，先用一个简短握手协商密钥并验证身份，之后才把 HTTP 流量送进隧道。从外部看，旁观者只能看到一串加密字节；内部两端则照常收发 HTTP 请求和响应。
What TLS actually does: the handshake in three stages
TLS 到底做了什么：三段式握手
A TLS 1.3 handshake is short, elegant, and worth understanding. It happens in roughly one round trip and produces a shared symmetric key that both sides will use for the rest of the session. The three stages map onto the three goals of any cryptographic key exchange: agree on a secret, prove who you are, and start talking.
TLS 1.3 的握手简短、优雅，值得理解。它大约只用一个来回（round trip）就能完成，并产生一个双方后续会话共用的对称密钥。这三个阶段对应任何一次密钥交换的三个目标：协商一个秘密、证明你是谁、然后开始对话。
Key exchange. The client sends a "Client Hello" with a random value, the list of cipher suites it supports, and — most importantly — a public key share for an ephemeral Diffie-Hellman group such as X25519. The server replies with its own key share, the chosen cipher suite, and its certificate. From those two key shares, both sides immediately derive the same shared secret. Crucially, this secret is never sent over the wire; it is computed independently on each side from the other side's public share and your own private share. Even if someone records every byte of the handshake, they cannot reconstruct the secret without the private keys — and those never leave memory.
密钥交换。 客户端发出"Client Hello"，其中包含一个随机数、它支持的密码套件列表，以及 —— 最关键的 —— 一个针对临时 Diffie-Hellman 群（如 X25519）的公钥份额。服务器回复自己的密钥份额、选定的密码套件，以及它的证书。凭借这两份公钥份额，双方就能立刻推导出同一个共享秘密。关键在于，这个秘密从不上线传输；它由每一方各自基于对方的公钥份额和自己的私钥份额独立算出。即使有人完整记录了握手的每一个字节，没有私钥也无法重建出这个秘密，而私钥从不离开内存。
Authentication. The key exchange alone proves nothing about identity. The server proves it controls the domain by presenting an X.509 certificate that is signed by a trusted Certificate Authority, and by signing the handshake transcript with the private key matching that certificate. The browser verifies the chain back to a root in its trust store. If the signature does not match, the certificate is expired, or the chain does not lead anywhere trusted, the browser stops you with a full-screen warning.
身份认证。 单纯的密钥交换并不能证明身份。服务器通过出示一张 X.509 证书来证明自己拥有该域名的控制权，这张证书由受信的证书颁发机构（CA）签发，并使用与证书中公钥对应的私钥对握手记录进行签名。浏览器会沿着这条链一直验证到根证书。如果签名对不上、证书已过期，或者链条最终没有落到任何受信根证书上，浏览器就会用全屏警告阻止你继续访问。
Encrypted channel. Once both sides have the shared secret and the server's identity is accepted, the client sends a "Finished" message that is itself encrypted and authenticated. From that point on, every byte of HTTP traffic — including the URL path — is encrypted with a fast symmetric cipher (today usually AES-GCM or ChaCha20-Poly1305) and protected against tampering. The handshake is over; the rest is just fast symmetric cryptography.
加密通道。 当双方都拿到了共享秘密，并且服务器的身份被接受后，客户端会发送一条本身就经过加密和认证的"Finished"消息。从这一刻起，每一字节的 HTTP 流量 —— 包括 URL 路径 —— 都会使用快速的对称密码（如今通常是 AES-GCM 或 ChaCha20-Poly1305）加密并防止篡改。握手至此结束，剩下的只是高效的对称加密。
Certificates, CAs, and the chain of trust
证书、CA 与信任链
A TLS certificate binds a public key to a domain name (and optionally to an organization). The binding is signed by a Certificate Authority, which vouches for it. Your browser and operating system ship with a list of trusted root CAs — currently around 150 organizations worldwide, including governments, commercial CAs, and non-profits. If a certificate chains back to any of those roots, the browser accepts it; if not, the browser rejects it.
TLS 证书把一个公钥绑定到一个域名（可选地还包括组织）。这种绑定由证书颁发机构签名背书。浏览器和操作系统内置了一份受信根 CA 列表 —— 目前全球大约 150 家机构，包括政府、商业 CA 和非营利组织。一张证书如果能沿着链路追溯到其中任何一个根，浏览器就接受它；否则浏览器就拒绝。
This model has obvious fragility. Any of those 150 organizations can mint a certificate for any domain. A few high-profile incidents — DigiNotar in 2011, Symantec in 2017, and several smaller misissuances — showed that the system works only as well as the weakest CA. Two technologies have been added to compensate: Certificate Transparency requires every publicly trusted certificate to be logged in public, append-only, cryptographically verifiable logs, so misissuance is detectable. CAA records in DNS let a domain owner declare which CAs are allowed to issue for their domain. Together, they have made casual misissuance much rarer.
这个模型显然有其脆弱性。这 150 家机构中的任何一家，都可以为任何域名签发证书。一些高调事件 —— 2011 年的 DigiNotar、2017 年的 Symantec，以及若干较小规模的误签 —— 说明这套系统的好坏只取决于其中最弱的那家 CA。业界随后引入两项技术来弥补：证书透明度（CT） 要求每一张公开受信的证书都必须被记录到公开、只追加、可密码学验证的日志中，使误签可被检测；CAA 记录 则让域名所有者在 DNS 中声明哪些 CA 才有权为该域名签发证书。两者合力，让日常的误签变得罕见得多。
Self-signed vs Let's Encrypt: who do you trust?
自签证书 vs Let's Encrypt：你信谁？
A self-signed certificate is technically just as good at encrypting traffic as a CA-signed one — the math is identical. What it lacks is the third-party attestation that you are talking to the domain you intended. When you connect to a service over a self-signed cert, you have no cryptographic reason to believe the server is the legitimate one rather than an attacker on your network. For an internal lab or a personal project, that may be acceptable. For anything a stranger might reach, it is not.
从加密流量的能力看，自签证书和 CA 签发的证书在数学上完全等价 —— 底层数学是一样的。它缺少的是"第三方为你正在访问的域名背书"这件事。当你通过自签证书连上一个服务时，你没有任何密码学依据相信对方就是合法服务器，而不是网络里的某个攻击者。放在内部实验或个人项目里也许能接受；任何陌生人可能访问的服务都不能这样。
Let's Encrypt, launched in 2016 by the Internet Security Research Group, changed the economics of HTTPS. It issues free, automated, 90-day domain-validated certificates. The ACME protocol lets a server prove control of a domain by, for example, serving a specific token on a well-known URL or adding a specific DNS record. Renewal is automatic. As a result, encryption that used to cost money, take days, and require human attention is now free, instant, and unattended — and the fraction of web traffic that is HTTPS has gone from under 30% in 2016 to over 90% today.
Let's Encrypt 在 2016 年由 Internet Security Research Group 推出，改变了 HTTPS 的经济性。它免费、自动化地签发 90 天有效期的域名验证证书。ACME 协议让服务器能通过例如在特定 URL 提供令牌或添加特定 DNS 记录来证明对域名的控制。续期是自动的。结果，曾经要花钱、花几天、还要人来打理的加密，今天变成免费、即刻、无需照看的服务 —— 加密 Web 流量占比从 2016 年的不到 30% 上升到如今的 90% 以上。
What the padlock does not tell you
小锁并不能告诉你什么
The padlock tells you that the channel is encrypted and that someone a browser-trusted CA vouches for the domain. It does not tell you that the site is honest, that it will not sell your data, that it will not serve malware, that it has not been hacked, or that the organization behind it is reputable. A phishing site can have a perfectly valid HTTPS certificate. A scam site can have a five-year-old EV certificate that cost thousands of dollars. Encryption is a transport-layer guarantee, not a trust signal.
小锁只能告诉你：通道是加密的，并且有某个浏览器信任的 CA 为这个域名背书。它并不能告诉你这个网站是诚实的、不会出售你的数据、不会投递恶意软件、没被黑过，或者背后的组织是可信的。一个钓鱼网站可以拥有一张完全合法的 HTTPS 证书；一个诈骗网站可以持有一张价值几千美元、有效期长达五年的 EV 证书。加密是传输层保证，不是信任信号。
The visual cues that do matter are the domain name itself and any verifiable identity information the browser surfaces. Always read the domain. Beware of homograph tricks where Cyrillic or Greek letters stand in for Latin ones. Beware of subdomain tricks where the "real" domain is a left-most label rather than the right-most one: login.microsoft.com.attacker.example is on attacker.example, not on microsoft.com. The padlock is necessary; it is not sufficient.
真正能起作用的视觉线索是域名本身，以及浏览器展示出来的、可以核实的身份信息。请始终看清域名。警惕同形异义字（homograph）陷阱 —— 用西里尔字母或希腊字母冒充拉丁字母；警惕子域名陷阱 —— 最左边那段是标签，最右边那段才是真正的域名：login.microsoft.com.attacker.example 是在 attacker.example 上，而不是 microsoft.com。小锁是必要的，但远不充分。
Hardening: HSTS, certificate transparency, and misconfigurations
加固：HSTS、证书透明度与常见配置错误
A few additional mechanisms make HTTPS stronger. HSTS (HTTP Strict Transport Security) is a response header that tells a browser: for the next period (often a year or two), only ever contact this domain over HTTPS — even if a user types http://. It closes the downgrade attack where an attacker strips the encryption. OCSP stapling lets the server prove in real time that its certificate has not been revoked, without leaking the user's browsing to the CA. Certificate Transparency logs catch misissuance by anyone.
还有一些机制能让 HTTPS 更坚固。HSTS（HTTP 严格传输安全）是一个响应头，告诉浏览器：在接下来一段时间（通常是一到两年）内，无论用户输入的是不是 http://，都只通过 HTTPS 访问该域名。它能堵住攻击者去除加密的降级攻击。OCSP 装订让服务器能实时证明自己的证书未被吊销，又无需让用户的访问泄露给 CA。证书透明度 日志则让任何误签都无处隐藏。
Common misconfigurations still appear in the wild. Mixed content — loading an HTTP image or script inside an HTTPS page — is blocked by modern browsers but can silently break features. Expired certificates take sites offline and erode user trust. Old protocols like TLS 1.0 and 1.1 are deprecated and should be disabled server-side; only TLS 1.2 and 1.3 should be enabled. Weak ciphers and missing forward secrecy can also linger in older configurations. Tools like SSL Labs' SSL Test and Mozilla's SSL Configuration Generator make it easy to verify and standardize a deployment. The padlock is the user-facing result; getting there is a checklist of small, well-understood decisions.
野生环境中仍然能见到常见配置错误。混合内容 —— 在 HTTPS 页面里加载 HTTP 图片或脚本 —— 会被现代浏览器拦截，但也可能悄悄破坏功能。证书过期会让站点下线并损耗用户信任。老协议如 TLS 1.0 和 1.1 已弃用，应在服务端关闭，只启用 TLS 1.2 和 1.3。弱密码套件和缺失前向保密也可能遗留在老配置里。SSL Labs 的 SSL Test 和 Mozilla 的 SSL Configuration Generator 让我们能方便地验证和规范化部署。小锁是面向用户的结果；走到这一步其实是一份由许多小而清晰的决策组成的清单。
Try the tools
试试这些工具
Once you understand how TLS protects a channel, the rest of online security is about what flows through that channel. Generate strong, unique credentials for the accounts behind it with the password generator, or experiment with encoding URLs and headers using the URL encoder. All processing happens locally in your browser, so what you type never leaves your device.
一旦理解了 TLS 是如何保护通道的，在线安全的其余部分就变成了"通道里流过的是什么"。用密码生成器为通道后面的账号生成强而独立的凭据，或者用URL 编码工具 试着编码 URL 和请求头。所有处理都在你的浏览器本地完成，输入的内容不会离开设备。