The security of HTTPS is that in the underlying TLS, which usually uses long-term private and non-private keys to deliver a brief-phrase session vital, which happens to be then accustomed to encrypt the data flow involving the customer as well as server. X.509 certificates are used to authenticate the server (and sometimes the consumer too). Like a