Computing · Secondary 4

Active learning ideas

Encryption in Everyday Life: HTTPS and Digital Certificates

Encryption in HTTPS and digital certificates can feel abstract to students, but active, hands-on exploration transforms these concepts from technical details into tangible tools they use daily. When students inspect real browser elements or simulate protocols themselves, they see the direct impact on their own digital safety.

• MOE Syllabus Outcomes
• MOE: Cybersecurity - S4
• MOE: Data Security - S4

• 30–45 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Case Study Analysis
• 30 min · Pairs

Browser Inspection: Spotting HTTPS

Direct students to open browsers and visit secure sites like banking pages. Instruct them to click padlock icons, view certificate details, and note issuer and validity. Pairs discuss differences between HTTP and HTTPS pages.

Explain why HTTPS is important when browsing the internet or making online purchases.

Facilitation Tip

During Browser Inspection: Spotting HTTPS, have students work in pairs to compare HTTP and HTTPS sites side by side, noting differences in the address bar and page load behavior.

What to look for

Ask students to write down two reasons why HTTPS is crucial for online shopping. Then, have them list one visual cue they look for in their browser to confirm a website is secure.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 02

• Case Study Analysis
• 45 min · Small Groups

Certificate Chain Role-Play

Assign roles: website owner, CA, browser. Students simulate certificate issuance and verification process using printed templates. Groups present chains, explaining trust from root CA to site cert.

How do you know if a website is secure and trustworthy?

Facilitation Tip

For Certificate Chain Role-Play, assign clear roles (Certificate Authority, website, browser) and provide scripted prompts to keep the simulation focused on the chain of trust.

What to look for

Present students with screenshots of two different websites, one using HTTP and one using HTTPS. Ask them to identify which is secure and explain their reasoning based on browser indicators and the protocol used.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 03

• Case Study Analysis
• 35 min · Small Groups

Phishing Detection Challenge

Provide screenshots of real and fake sites. Students check HTTPS status, cert validity, and URL anomalies in small groups. Class votes and debriefs common red flags.

Analyze the role of digital certificates in establishing trust online.

Facilitation Tip

In the Phishing Detection Challenge, provide a mix of real and fake URLs with subtle differences, then ask students to justify their choices using both visual cues and certificate details.

What to look for

Facilitate a class discussion by asking: 'Imagine you are advising a friend who is new to online shopping. What key advice would you give them about verifying a website's trustworthiness before entering personal or payment details?'

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 04

• Case Study Analysis
• 40 min · Whole Class

TLS Handshake Simulation

Use online tools or physical cards to model client-server handshake. Students sequence steps: hello, key exchange, encryption start. Discuss interruptions like expired certs.

Explain why HTTPS is important when browsing the internet or making online purchases.

What to look for

Ask students to write down two reasons why HTTPS is crucial for online shopping. Then, have them list one visual cue they look for in their browser to confirm a website is secure.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

A few notes on teaching this unit

Teaching encryption through real-world tools builds engagement and retention. Avoid diving into the mathematics of TLS, which can overwhelm students. Instead, use browser tools and simulations to make abstract ideas concrete. Research shows that when students manipulate these tools themselves, their understanding of trust and verification improves significantly compared to passive instruction.

By the end of these activities, students will confidently identify HTTPS connections, explain the role of digital certificates, and distinguish encryption from authentication. They will also recognize why visual cues like padlocks matter and when they might be misleading.

---

Watch Out for These Misconceptions

• During Browser Inspection: Spotting HTTPS, watch for students assuming the padlock icon means a site is completely trustworthy.

  Use the activity’s side-by-side comparisons to highlight that HTTPS only encrypts data, not site legitimacy. Ask students to find examples of phishing sites that use HTTPS and discuss why the padlock alone is insufficient.

• During Certificate Chain Role-Play, watch for students conflating certificates with passwords or secret keys.

  Have students examine the actual certificate structure in their browsers during the role-play, pointing out that certificates are public keys with identity proofs, not secrets to be hidden.

• During TLS Handshake Simulation, watch for students believing encryption significantly slows down websites.

  Use the simulation’s timing features to compare secure and insecure loads, emphasizing that modern TLS adds minimal overhead. Collect data as a class to address the misconception with evidence.

---

Methods used in this brief

• Case Study Analysis