TLS & HTTPS Explained Simply for Beginners 🌐

What's TLS? What's HTTPS? How does http work? What's SSL? We use TLS all the time. In this video I attempt the underlying concepts as simply as I can.

Sections in the video if you want to skip to the good stuff:

Chapters:
00:00 Introduction
1:11 Asymmetric Encryption
1:50 What's a Certificate?
2:24 Real Life Example of trusting an unknown party:
4:20 Self Signed Certificates,
4:50 Root CA, Intermediate CA, Leaf Certs
6:15 Obtaning a Cert (CSRs)
7:40 Full Chain Certs
8:32 Can you forge/steal a Certificate?
10:58 TLS, Encryption, Handshake, Purpose, Issues

TLS Section:
11. Intro to TLS Handshake: 10:58
12. Symmetric Encryption: 11:45
13. The purpose of the Handshake 11:59
14. Handshake step by step: 12:20
15. Issues with TLS: 14:16
16. TLS 1.3 14:48
17. Disclaimer: 16:12
18. Wrapping up: 16:24

Here are a couple of bonus points that I don't mention in the video:
1. You can use TLS for anything, it's at a lower layer than your application data, so you can exchange HTTP on top of TLS, but also other things, like your own proprietary binary protocol.
2. Sometimes I ask people to test their understanding of HTTPS: When you do a POST to a url, the body is encrypted, but what about the URL?
Some people reply yeah, the URL too, others reply: No, the URL is not encrypted.
The correct answer is: Encryption happens before any HTTP data is sent, during the TLS Handshake, so ANYTHING you send over that connection once the channel is sent, is encrypted, including of course, the URL.

Apple's List of Pre installed Root CA Certificates: https://support.apple.com/en-us/HT209144

Apple's Root Certificate Program: https://www.apple.com/certificateauthority/ca_program.html

A great article on the handshake for TLS and where I got the diagrams: https://www.thesslstore.com/blog/explaining-ssl-handshake/

A good video on the TLS Handshake: https://www.youtube.com/watch?v=cuR05y_2Gxc

Video by same guys on TLS 1.3 Handshake improvements: https://www.youtube.com/watch?v=yPdJVvSyMqk