Click the padlock in your browser bar. That’s the thing you’ve ignored ten thousand times. Today: what it checks, what it promises — and what it doesn’t.
Big Idea 5 — Impact of ComputingCED 5.6 · 4.1 · completes 6.11’s HTTPS
Before this lesson
No reading — this page is the reading. Bring 7.4’s pairing rule and 6.11’s photo trip. Today they snap together.
Security wraps the Internet. The photo trip from 0.1 is now both traced (6.11) and secured.
2
The Hook
Click the padlock.
In any browser, click the icon to the left of the address on a secure site and open the certificate details.
Find two things: who the certificate was issued to, and who it was issued by.
If your Chromebook won’t show certificate details, watch the projector.
3
The Idea
7.4 left one problem. A public key lets you encrypt to someone — but how do you know the
key really belongs to your bank, and not to an impostor who swapped in their own?
A digital certificate is a document saying “this public key belongs to this site,”
digitally signed by a certificate authority (CA) — a trusted third party. Your browser
comes with a built-in list of CAs it trusts, and it checks the signature (7.4’s signature idea, doing real
work).
HTTPS, assembled from parts you now own:
Certificate — the browser checks the site is who it claims, vouched for by a CA.
Asymmetric encryption — used briefly to agree on a fresh shared secret key.
Symmetric encryption — carries all the actual traffic, because it’s far faster.
Name the limits — they’re as testable as the protection. HTTPS protects the
contents while they travel. It does not hide which site you connected to, and it does nothing
once your data is sitting on the company’s servers. A padlock also doesn’t mean a site is honest
— scam sites get certificates too.
A browser warning page means one of the checks failed: the certificate expired, was issued for a different
name, or wasn’t signed by a CA the browser trusts. Read what it says before clicking past it.
4
Try It — The Handshake, Then What It Hides
Part 1. Step through what happens when you open https://photos.example.com.
Part 2. On an HTTPS connection, can someone watching the network see it?
5
Vocabulary
digital certificate Security
A document, signed by a certificate authority, that links a website’s name to its public key.
certificate authority (CA) Security
A trusted organization that verifies identities and signs certificates.
HTTPS Security
HTTP over an encrypted connection: certificate check, then asymmetric encryption to agree on a key, then symmetric encryption for the traffic.
trust model Security
The chain of who trusts whom. Your browser trusts certain CAs; CAs vouch for sites.
6
Check
Five questions. Two are about what HTTPS does not do.
0 of 5 answered
7
Impact Check
The padlock is not a safety rating
A padlock means your connection to that site is encrypted and the site
really controls that name. It says nothing about whether the site is honest. A scam site at a look-alike address
can have a perfectly valid certificate for its own look-alike name. Check the name, not just the lock.
8
Connections
Came from 6.11 — the HTTPS placeholder, now filled in.
Came from 7.4 — signatures (certificates) and key exchange, both in one handshake.
Came from 5.2 — metadata: who you talked to and when stays visible even when content is encrypted.
Next in 7.6 — a secure connection to the right site still needs to know it’s really you logging in.