What is the difference between HTTP and HTTPS, and how does the SSL/TLS handshake work?

Question

Accepted Answer

The HTTP protocol is used to transmit hypertext on the web, but all information transmitted between the client and the server is sent in plaintext. The HTTPS protocol is a secure version of HTTP that adds a cryptographic encryption layer using SSL orTLS technologies on top of the standard transport protocol, ensuring data confidentiality and integrity.

To establish a secure connection before transmitting the main data, a cryptographic handshake process takes place. First, the client and server greet each other, negotiate supported encryption algorithms, and exchange certificates to verify the server's authenticity. Then, a shared secret session key is generated using asymmetric cryptography.

After the handshake is complete, all subsequent HTTP requests and responses are encrypted using symmetric encryption, which works significantly faster and does not create a heavy load on the processor. The main stages of ensuring security include the following actions:

1. Checking the validity and expiration date of the domain's SSL certificate with a trusted Certificate Authority.
2. Exchanging random numbers to protect against replay attacks.
3. Generating a unique symmetric key for the specific user session.
4. Switching to secure exchange of encrypted application-layer packets.

What is the difference between HTTP and HTTPS, and how does the SSL/TLS handshake work?

More questions in this topic

Related questions from other topics