HTTPS and TLS

Plain HTTP has a problem: everything travels as readable text. Your password, the page you asked for, the cookie that keeps you logged in, all of it can be read by anyone on the path between you and the server, from the café's Wi-Fi to every network in between.

Netscape built SSL to fix that for the early commercial web. The IETF took it over, and in January 1999 published RFC 2246, TLS 1.0, stating that it was based on Netscape's SSL 3.0. The name changed; the job did not.

For years, though, the padlock cost money and manual work, and most of the web stayed unencrypted. That changed on 14 September 2015, when a new certificate authority called Let's Encrypt issued its first certificate.