How does HTTPS and TLS work? What is a certificate and how does a browser verify it?

HTTPS is an extension of HTTP using the TLS (Transport Layer Security) protocol to encrypt data between the client and server. TLS ensures confidentiality, integrity, and authentication.

How HTTPS/TLS works:

1. The client initiates a connection to the server.
2. The server sends its digital certificate, which contains the public key and server information, signed by a Certificate Authority (CA).
3. The client verifies the certificate: checks the CA signature, validity period, and domain match.
4. If the certificate is valid, the client and server agree on encryption parameters and establish a shared secret (e.g., through key exchange).
5. All subsequent data is encrypted using this secret.

A certificate is an electronic document that confirms the ownership of a public key by a specific entity (server). It is signed by a trusted CA, ensuring its authenticity.

Browser certificate verification:

• Checks the certificate chain up to a trusted root CA.
• Checks the certificate's validity period.
• Ensures the domain name in the certificate matches the website address.
• Checks whether the certificate has been revoked (via CRL or OCSP).

Example in Go for an HTTPS server:

http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
    w.Write([]byte("Hello, HTTPS!"))
})

err := http.ListenAndServeTLS(":443", "server.crt", "server.key", nil)
if err != nil {
    log.Fatal(err)
}