What Is an SSL/TLS Certificate? The Padlock Icon Explained

Open your banking app's website right now and look at the address bar. There's a small padlock sitting next to the URL, and most people have never clicked on it once. That tiny icon is doing more work than almost anything else on the page, and it's worth five minutes to understand what it's actually promising, because it's less than you might think.

What's happening before the page even loads

Every time your browser connects to a site over HTTPS (the "S" stands for secure, and it's the padlock's job), two things happen almost instantly. First, the site proves who it is by presenting a certificate signed by an organisation your browser already trusts. Second, your browser and the server agree on a shared encryption key using a method called public-key cryptography, so that everything you send afterward — your password, your card number, your Aadhaar details on a government portal — is scrambled in transit.

Public-key cryptography is simpler than the name suggests: the server has two mathematically linked keys, one public and one private. Anyone can use the public key to lock a message, but only the server's private key can unlock it. This is the same underlying idea behind how encryption protects your data more broadly — SSL/TLS is just that principle applied specifically to your connection with a website.

Who actually vouches for a website

The certificate itself is issued by a Certificate Authority (CA) — a handful of organisations worldwide, like DigiCert or Let's Encrypt, that browsers and operating systems are pre-configured to trust. When a website owner wants a certificate, the CA checks that they genuinely control the domain (and for higher-tier certificates, sometimes the business itself) before signing it. Your browser then checks that signature against its own trusted list every time you visit.

This is why a certificate warning — the red "Your connection is not private" screen — is worth taking seriously rather than clicking through. It usually means one of three things:

• The certificate has expired and nobody renewed it in time
• The certificate doesn't match the domain you're actually on
• Something is actively intercepting your connection, which is rarer but far more serious

What the padlock does not mean

Here's the part that trips people up: HTTPS tells you the connection is encrypted and that you're talking to the domain you think you are. It says nothing about whether that domain is trustworthy. Free certificates from Let's Encrypt take seconds to issue, which is great for legitimate small websites but also means a phishing site mimicking your bank's login page can have a padlock too. The scammers behind digital arrest frauds and fake loan-app sites routinely register HTTPS-secured domains that look almost identical to the real thing.

A padlock means "nobody can eavesdrop on this conversation." It has never meant "this is who it claims to be having the conversation with."

So the padlock is necessary but nowhere near sufficient. Checking the actual domain spelling still matters more than checking for the icon.

Why this matters more for Indian users specifically

India runs an unusual share of its daily life through the browser and through apps that embed web views — UPI-linked merchant pages, income tax e-filing, state government portals, insurance renewals. The RBI has pushed banks and payment aggregators toward strict transport security for years, and under the Digital Personal Data Protection (DPDP) Act, any platform handling Indian users' personal data carries a legal obligation to protect it in transit, not just in storage. A misconfigured or expired certificate on a fintech or healthtech site isn't just an inconvenience here — it can mean a lapse against that obligation.

It also matters because so much of India's internet traffic happens over shared or public Wi-Fi — airports, railway stations, cafés — where an unencrypted connection is trivially easy to snoop on. TLS is precisely what stands between a stranger on the same network and your session cookie.

Checking a certificate yourself

You don't need to be a developer to do this. On desktop, click the padlock icon, then "Connection is secure" or "Certificate," and your browser will show you who issued it and how long it's valid. On mobile, most browsers bury this one tap deeper in the site-info menu, but it's there. If you're ever unsure about a payment page, this ten-second check is more useful than staring at the padlock itself.

The honest takeaway is that TLS solved one problem extremely well — eavesdropping — and was never built to solve a different one, which is figuring out whether the entity on the other end deserves your trust. Keep verifying the domain name by eye, and treat the padlock as table stakes, not a seal of approval.