What is SSL? The Lock Icon in Your Browser

The TLS Handshake: How Encryption Actually Starts

When you visit an HTTPS website, your browser and the server perform a quick negotiation called the TLS handshake before any data is exchanged. It happens in milliseconds, but a lot is going on.

The Handshake Step by Step

1. Client Hello — Your browser says "Hey, I want a secure connection. Here are the encryption methods I support."
2. Server Hello — The server picks the best encryption method from the list and sends back its SSL certificate (which contains its public key).
3. Certificate Check — Your browser verifies the certificate is valid, not expired, and was issued by a trusted Certificate Authority (CA).
4. Key Exchange — Your browser and the server agree on a shared secret key using the public key from the certificate. This key will encrypt all further communication.
5. Secure Connection — Both sides confirm the handshake is complete. Everything from here on out is encrypted.

The whole thing takes about 50-100 milliseconds. You don't notice it, but it's the reason you can safely type your credit card number into a website.

Certificate Authorities and Trust Chains

So who decides which certificates are trustworthy? That's where Certificate Authorities (CAs) come in. A CA is an organization trusted by browsers to verify that a website is who it claims to be.

The trust works as a chain:

• Your browser trusts a handful of root CAs (built into the browser)
• Those root CAs trust intermediate CAs (which actually issue most certificates)
• The intermediate CA trusts your site's certificate

If any link in the chain is broken or expired, your browser shows a security warning. Cloudflare manages this entire chain for you, which means you never have to worry about renewing or configuring intermediate certificates.

DV vs. OV vs. EV Certificates

Not all SSL certificates are created equal:

• DV (Domain Validation) — Proves you own the domain. That's it. Issued in minutes, usually free. This is what Cloudflare provides automatically, and it's what most websites need.
• OV (Organization Validation) — The CA also verifies your business is real (checks business registration, phone number, etc.). Takes a few days. Adds more trust but visitors can't easily tell the difference.
• EV (Extended Validation) — The most thorough check. The CA investigates your legal identity, physical address, and operational existence. Used to show a green company name in the browser bar (most browsers removed that visual indicator, so the benefit has shrunk).

For the vast majority of small business websites, DV is perfectly fine. It's the same level of encryption — the difference is only in how thoroughly the CA checked who you are.

Certificate Transparency

Certificate Transparency (CT) is a system that logs every SSL certificate issued publicly. This means anyone can check if a certificate was issued for their domain — catching unauthorized certificates quickly.

If someone tricked a CA into issuing a fake certificate for yourbank.com, CT logs would expose it. Cloudflare participates in CT and monitors certificates for domains they manage.

Questions about your site's SSL setup? Reach out — we'll make sure your encryption is solid and your certificates are current.