How does HTTPS/TLS protect traffic, and what is HSTS?
Take a moment.
Say your answer out loud or write it down first — retrieval is what makes it stick. Reveal when you're ready.
Short answer
TLS negotiates a cipher suite, authenticates the server via its certificate chain, then encrypts everything (headers, body, cookies) so intermediaries see only domains, not content. HSTS (Strict-Transport-Security) tells browsers to use HTTPS exclusively for your domain going forward — closing SSL-stripping downgrade attacks.
Detailed explanation
The handshake (1-RTT in TLS 1.3) does three jobs: the client and server agree on a cipher suite and exchange key material (ephemeral Diffie-Hellman gives forward secrecy — a later key theft can't decrypt recorded traffic); the server presents its certificate, which the browser validates against trusted CAs, hostname, and expiry (this authentication is what defeats impersonation — encryption without identity is useless); then all HTTP bytes flow inside the encrypted channel, hiding paths, query strings, headers, and bodies from Wi-Fi snoopers and middleboxes. What TLS doesn't hide: the destination IP and (usually) the domain via SNI — privacy needs more than TLS. HSTS fixes the first-visit problem: without it, a user typing example.com or clicking an http:// link starts in plaintext, and an active attacker can strip the redirect to HTTPS (SSL stripping). With Strict-Transport-Security: max-age=31536000; includeSubDomains (ideally preload-listed), the browser internally upgrades every request before any packet leaves — no plaintext window exists. Operational notes: mixed content (an https page loading http subresources) gets blocked and breaks features — serve everything over HTTPS; certificates expire, so automate renewal (ACME/Let's Encrypt) and monitor; and prefer TLS 1.2+ only, disabling legacy protocols and weak ciphers.
Example
# Inspect a site's TLS posture in seconds
# openssl s_client -connect example.com:443 -tls1_3
# → Protocol: TLSv1.3, Verify return code: 0 (ok), chain depth + expiry
# HSTS header your server (or CDN) should send on every HTTPS response:
# Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
# Mixed content that browsers will block on your https page:
# <script src="http://cdn.example.com/lib.js"></script> <!-- blocked -->
# <script src="https://cdn.example.com/lib.js"></script> <!-- fine -->Interview tip
Name the handshake's three jobs (negotiate, authenticate, encrypt), then explain which attack HSTS kills (SSL stripping on first contact). Mentioning forward secrecy signals depth.
Common mistakes
- Believing encryption alone is enough — without certificate authentication there is no identity.
- Deploying HSTS with a short max-age or forgetting subdomains.
- Leaving http:// subresources that mixed-content blocking then breaks.