HTTPS, packet by packet
Follow one request from start to finish, and the response back. Choose who is asking, press play, and tap any arrow to see what happens at that moment. Technical details stay folded away until you want them.
Technical details fields, layers, packet
Browser vs daemon app
Both speak the same HTTPS. What differs is who decides what to trust, how they prove who they are, and what happens when something goes wrong.
| Browser | Daemon app | |
|---|---|---|
| Who starts it | A person presses Enter or clicks | A timer, queue message or another service |
| Where the URL comes from | Address bar or link | Configuration |
| Forcing HTTPS | HSTS list, HTTPS-first mode | Only whatever the config says |
| DNS | Encrypted DNS (DoH), uses HTTPS records | Usually plain DNS on a private network |
| Who it trusts | Browser root store, plus Certificate Transparency checks | OS or container CA bundle; CT and revocation often unchecked |
| Proving who it is | Cookies after a login | OAuth client credentials, API keys or mTLS |
| Bad certificate | Full-page warning | Exception in code, retries, an alert to on-call |
| Connections | Managed by the browser, shared across tabs | A pool the developer configures |
| Server errors | Error page; the person reloads | Backoff, retries and idempotency keys |
| Result | A rendered page | Parsed JSON and a log line |
What TLS protects, and what it doesn’t
Try the “No TLS” and “Fake certificate” scenarios to see these in action.
Nobody can read it
Without TLS, URLs, cookies, passwords and tokens cross every hop as plain text.
Nobody can change it
Without TLS, anyone in the path can inject scripts, swap downloads or rewrite forms, undetected.
You know who answered
The certificate proves the server is really the named host. Skipping that check makes the encryption pointless.
What HTTPS leaves exposed
IP addresses, traffic sizes and timing, DNS lookups without encrypted DNS, and the hostname without ECH. A secure connection also says nothing about whether the site is honest.
SSL is the old name for TLS
SSL was Netscape’s protocol from the 1990s; the IETF renamed its successor TLS. Every SSL version is broken and banned, but “SSL certificate” stuck as the everyday name for a TLS certificate.
Curious about the top layer?
The companion page covers Layer 7 on its own: HTTP anatomy, load balancers and gateways, other protocols, and attacks.