Short answer
HTTPS protects the contents of the connection against eavesdropping and tampering on the way.
What the certificate does
The certificate helps the browser verify that it is talking to the right website and that encryption can be established safely.
What HTTPS does not guarantee
HTTPS does not automatically mean the website is honest. It protects the connection, but you can still visit a fake or malicious site.
Why the lock icon matters
Without HTTPS, others on the network may in some cases read or modify traffic. Login, forms and payments should always use HTTPS.
Common questions
Can the provider see everything with HTTPS?
The provider can normally see the domain or connection patterns, but not the page contents in the same way.
Is HTTP unsafe?
For logins and sensitive data, yes. Regular information sites should also use HTTPS today.