Who proves what, played one role at a time: the CA vouches, the server proves its name, the browser checks, and an impostor tries to get past it
click a step for its explanation