Is SSL different from TLS?

SSL is the predecessor protocol, and every version of it is broken and disabled; SSL 3.0 died for good after the POODLE attack in 2014. Everything in production today is TLS 1.2 or 1.3. The phrase "SSL certificate" survives purely as naming inertia; the certificate itself is the same X.509 document either way.

Does the padlock mean a site is safe?

No. It means the connection to that site is encrypted and the certificate matches the domain. Phishing sites obtain valid certificates in minutes, so a padlock on a lookalike domain proves only that your traffic to the scammer is private. TLS authenticates the channel, not the character of the business behind it.

Is it acceptable to terminate TLS at the load balancer and run plain HTTP inside?

It's common and defensible for small systems inside a private VPC, and it was the default answer for years. Regulated environments and zero trust architectures now re-encrypt to backends or run mTLS between services, usually via a service mesh. The interview-safe answer names the tradeoff: operational simplicity against trusting your internal network.

Securitychapter 1 of 4 · 4 lessons

HTTPS / TLS

TLS encrypts data in transit; HTTPS is HTTP over TLS.

← All chapters View in cheatsheet

Somebody opens your app on the free wifi in a coffee shop. Between their laptop and your server sit the cafe's router, an internet provider, and a handful of networks nobody in the room has heard of.

Over plain HTTP, anyone on that wifi can read every request with software that has existed for twenty years. They can also change the reply on its way back, and they can pretend to be your server entirely.

Until around 2012, most large sites encrypted the login page and then sent the session cookie in the clear afterwards. Stealing somebody's account needed no password at all, just a laptop in the same cafe.

TLS is what makes that network tolerable, and HTTPS is **TLS** underneath the HTTP you already know. What it protects is narrower than most people assume, and that boundary is worth knowing exactly.

Lessons

4 in this chapter

What TLS Protects AgainstRead, modify, impersonate: the three network attacks TLS shuts down, and the ones it leaves open.2 min
The TLS 1.3 HandshakeOne round trip to agree on keys, prove the server's identity, and start encrypting.2 min
Certificates and the Chain of TrustHow a signature chain from your domain to a root store makes a public key trustworthy.3 min
TLS Termination in Real ArchitecturesDeciding where encryption ends: at the edge, at the load balancer, or nowhere.2 min