At a high level, what happens during a TLS/HTTPS handshake, and what makes the connection secure?
What they are really testing: Whether you understand certificates, the asymmetric-to-symmetric key handoff, and identity, not just "it is encrypted." Cloud engineers terminate TLS constantly.
A real interview question
At a high level, what happens during a TLS/HTTPS handshake, and what makes the connection secure?
What most people say
drag me
“The data gets encrypted with the SSL certificate so nobody can read it.”
It conflates the certificate with the encryption and ignores identity. The cert proves who the server is; the encryption uses a negotiated session key. Missing that is a real gap for anyone managing TLS.
The follow-ups they ask next
What does a Certificate Authority actually vouch for?
That the public key in the cert belongs to the named domain. Browsers trust a set of root CAs; a cert chaining to one of them, with a matching hostname and valid dates, is trusted.
What breaks when a certificate expires?
Validation fails, so clients refuse the connection (browser warning, failed API calls). It is a frequent outage cause, which is why you automate renewal (for example ACM or cert-manager).
What the interviewer is listening for
- Separates identity (cert) from encryption (session key)
- Mentions CA validation/hostname check
- Knows asymmetric sets up a symmetric key
What sinks the answer
- "The certificate encrypts the data"
- No mention of identity/CA
- Thinks the whole session is asymmetric
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“The handshake does two jobs: [prove identity and set up encryption]. The server shows [a certificate the client validates against a trusted CA]. Then [a key exchange derives a shared symmetric session key without sending it in the clear]. The session then uses [fast symmetric crypto]. Security = [the cert proves who you talk to + the session key keeps it private].”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free