What the HTTPS padlock means: how your browser talks in secret on a Wi-Fi anyone can read
Domain validation: why a scam website can show the HTTPS padlock too
The padlock does not mean that a website is honest. Scam websites get real HTTPS certificates too. Before each certificate is given, someone checks just one thing.
-
1
The check is plain. The authority sends a random code and asks the shop to put it on shop.example. Then the authority visits shop.example itself. If the code is there, whoever asked controls the name.
-
2
Since 2015, an authority called Let's Encrypt does it for free, with no person involved: a program on the website's server asks, places the code and gets the certificate in seconds. It serves more than 700 million websites.
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88