About HTTPS

Definition

HyperText Transfer Protocol Secure (HTTPS; often referred to as HTTP over TLS, HTTP over SSL, or HTTP Secure) is a communication protocol for secure communication over a computer network. HTTPS communicates via HTTP but uses SSL/TLS to encrypt data packets. The primary purpose of HTTPS is to provide authentication of the website server and protect the privacy and integrity of exchanged data. This protocol was first proposed by Netscape in 1994 and subsequently extended across the internet.

Why HTTPS Was Created

HTTPS emerged in response to HTTP’s insecurity. Simply put, HTTP’s lack of security led to HTTPS’s creation. The main issues are:

1. Content Encryption: Content transmitted from client to server is in encrypted form; intermediaries cannot directly view plaintext content. HTTP transmits in plaintext without encryption, making it easy for intermediaries to intercept.
2. Identity Authentication: Verification ensures the client is connecting to its own server.
3. Data Integrity: Prevents content from being impersonated or tampered with by third parties.

In short, HTTPS encrypts transmitted data, ensuring that even if intercepted, it won’t be leaked.

Encryption Methods

HTTPS combines both symmetric and asymmetric encryption:

• Symmetric Encryption: Encrypts the transmitted content
• Asymmetric Encryption: Encrypts the key for the symmetric encryption algorithm

The overall process:

1. The client sends a client_hello containing a random number random1;
2. The server replies with server_hello containing a random number random2 and carries the certificate public key P;
3. Upon receiving random2, the client can generate premaster_secret (the symmetric encryption key) and master_secret (data encrypted with premaster_secret);
4. The client encrypts premaster_secret using the certificate public key P and sends it to the server (encrypting premaster_secret with public key P);
5. The server uses its private key to decrypt and obtain premaster_secret. Since the server already received random number 1 earlier, it can compute the same master_secret using the same generation algorithm with the same input parameters.

As you can see, the key used for data transmission is transmitted via asymmetric encryption, while the data itself is transmitted via symmetric encryption. The symmetric encryption key is obtained in the previous step.

Therefore, the asymmetrically encrypted key transmission is extremely critical. Ensuring this transmission process is not eavesdropped on or hijacked is the most important link in the entire transmission process.

Technical Details

HTTPS’s primary function is to create a secure channel over an insecure network. With appropriate encryption suites and server certificates that can be verified and trusted, it provides reasonable protection against eavesdropping and man-in-the-middle attacks.

HTTPS trust is based on certificate authorities (CA) pre-installed in the operating system. Therefore, an HTTPS connection to a website can only be trusted under these conditions:

1. The browser correctly implements HTTPS and the operating system has correct and trusted certificate authorities installed;
2. The certificate authority only trusts legitimate websites;
3. The visited website provides a valid certificate, meaning one issued by a certificate authority trusted by the operating system (most browsers will warn about invalid certificates);
4. The certificate correctly validates the visited website (e.g., when visiting https://example.com, the received certificate is issued to example.com, not another domain).

This protocol’s encryption layer (SSL/TLS) effectively provides authentication and strong encryption.

For a web server to be ready to accept HTTPS connections, an administrator must create a digital certificate and have it signed by a certificate authority for browsers to accept. The certificate authority verifies that the digital certificate holder and the claimed entity are the same. Browsers typically come pre-installed with certificate authority certificates, so they can verify the signature.

1. The administrator must apply to a certificate authority for a digital certificate and sign it (specifying the domain), i.e., declaration;
2. During access, the browser verifies the certificate, i.e., validation;
3. After successful validation, data transmission can begin.

In the above stages, the asymmetric encryption verification and key transmission process is completed.