HTTP vs. HTTPS

TLS gives HTTPS three guarantees.

• Encryption. The data is scrambled with a secret key. Anyone who intercepts it sees only unreadable bytes.
• Authentication. The browser checks that it is really talking to the site it asked for. This prevents a man-in-the-middle attack, where an attacker intercepts the traffic between you and the server and pretends to be the server.
• Integrity. Any change to the data on the way is detected, so nobody can alter it without being noticed.

Authentication does work that encryption cannot do alone. An encrypted conversation with an attacker who pretends to be your bank protects nothing. The attacker simply decrypts everything you send.

How HTTPS Works

Before any HTTP data moves, the browser and the server run a TLS handshake. The handshake checks who the server is and creates a secret key for the conversation. Here are its main steps, simplified.

1. The browser says hello. It lists the encryption methods it supports and sends the first part of a key exchange.
2. The server replies. It picks an encryption method, sends its part of the key exchange, and sends its certificate.
3. The browser checks the certificate. It confirms that a trusted authority signed it, that it has not expired, and that it matches the domain name.
4. Both sides create the same secret key. Each side uses the key exchange to calculate the same key. The key itself never travels across the network.
5. Encrypted HTTP begins. Every request and response is now encrypted with that key.

With TLS 1.3, the current version, this handshake needs only one round trip between browser and server.

Two Kinds of Encryption

HTTPS uses two kinds of encryption because each one is good at a different job.

• Public-key encryption uses a pair of keys: a public key that anyone may see, and a private key that the owner keeps secret. It lets two sides agree on a secret key over a network that others can watch. But it is slow.
• Symmetric encryption uses one shared secret key for both encrypting and decrypting data. It is very fast, but both sides must already have the same key.

So HTTPS uses public-key encryption once, during the handshake, to agree on a key. Then it uses fast symmetric encryption, like AES, for all the data.

Certificates

A certificate is a digital document that proves a server owns a domain name. It contains the domain name, the server's public key, and an expiry date.

A certificate authority (CA) is a trusted organization that checks domain ownership and signs certificates. Browsers and operating systems come with a built-in list of CAs they trust. When a certificate is signed by one of them, the browser accepts it.

If an attacker intercepts the connection, they cannot show a valid certificate for your bank's domain. No trusted CA will sign one for them. So the browser shows a warning instead of connecting.

Certificates expire, so servers must renew them. Free CAs, like Let's Encrypt, issue certificates that last 90 days, and most teams renew them automatically.

Is HTTPS Slower?

HTTP is slightly faster because it does no encryption work. HTTPS is slightly slower because of the handshake and the encryption itself.

Today the difference is small, for three reasons.

• Modern processors have built-in support for encryption, so encrypting data costs very little.
• TLS 1.3 needs only one round trip for the handshake. A returning browser can also resume an earlier session and skip part of the work.
• One connection is reused for many requests, so the handshake does not repeat for each request.

HTTPS can even make sites faster. Browsers support the newer HTTP/2 protocol only over HTTPS, and HTTP/2 loads pages with many files more quickly.

Why HTTPS Became the Standard

For any site where users enter passwords, card numbers, or bank details, HTTPS is essential. But today it is used on almost every site, for more reasons than encryption.

• User trust. Browsers show a padlock icon for secure connections. They mark sites that use plain HTTP as "Not secure", so users trust them less.
• Search ranking. Search engines rank secure sites slightly higher, so HTTPS helps people find a site.
• Compliance. Many laws and industry rules require user data to be protected while it travels.
• Modern features. Many browser features, like HTTP/2 and location access, work only over HTTPS.

Most sites still listen on port 80, but only to redirect. A request to http:// gets a 301 response that points to the https:// address. Sites can also send an HSTS header (HTTP Strict Transport Security), which tells the browser to use HTTPS for that site every time.

What HTTPS Does Not Protect

HTTPS protects the content of the traffic. It does not hide everything.

• The domain name is usually visible. The network can still see that you visited shop.example.com, from the DNS lookup and the start of the handshake. It cannot see the path, like /orders/42.
• The IP addresses, timing, and amount of data are visible.
• HTTPS does not make a site honest. A fake login page can also have a valid certificate for its own domain. The padlock only means the connection is private, not that the site is safe.

HTTPS Inside a System

In a large system, HTTPS often ends at the load balancer, the server that spreads incoming requests across many app servers. This is called TLS termination. The load balancer holds the certificate, decrypts the traffic, and forwards the requests to the app servers.

This saves work on the app servers, and it keeps certificates in one place. Many teams also encrypt the traffic between their own servers. The network inside a data center may not be private, and TLS stops an attacker from pretending to be one of the services.

Key Takeaways

• HTTP (HyperText Transfer Protocol) moves data on the web as requests and responses. It is stateless, sends plain text, and uses port 80.
• HTTPS is HTTP over TLS, on port 443. It adds encryption, authentication, and integrity.
• Authentication, through certificates signed by trusted CAs, prevents man-in-the-middle attacks.
• TLS uses public-key encryption during the handshake to agree on a key, then fast symmetric encryption for the data.
• HTTPS is slightly slower than HTTP, but the difference is small today.
• HTTPS is essential for sensitive data, and it also brings user trust, better search ranking, and compliance.
• HTTPS hides the content of traffic, but not the domain name, IP addresses, or data size.

HTTP defines what a request and a response look like. HTTPS stops others from reading or changing them on the way. The next lesson, TCP vs. UDP, goes one layer down, to the protocols that actually carry these messages across the network.

Practice Questions

Try each question first, then open the answer.

1. A login page uses HTTP, and a user logs in on public Wi-Fi. What can an attacker on the same network do?

<details> <summary>Show answer</summary>

Read the password and change the page. HTTP sends plain text, so the username and password are readable to anyone who sees the traffic. The attacker can also change the response on its way to the user, for example to add a harmful script. HTTPS prevents both, with encryption and integrity checks.

</details>

2. Why does HTTPS need authentication? Would encryption alone not be enough?

<details> <summary>Show answer</summary>

Encryption alone does not tell you who is on the other end. An attacker could pretend to be the server and set up an encrypted connection with you. Everything would be encrypted, but the attacker would decrypt and read it. The certificate check proves the server owns the domain, which stops this man-in-the-middle attack.

</details>

3. A browser shows a warning that a site's certificate is not valid. Name two likely causes.

<details> <summary>Show answer</summary>

Common causes are an expired certificate and a domain mismatch. Certificates have an expiry date, and a team may forget to renew one. A domain mismatch happens when a certificate for one name, like www.example.com, is used on another, like shop.example.com. A third cause is a certificate that no trusted certificate authority signed.

</details>

4. Which ports do HTTP and HTTPS use by default? What does a modern site usually do with a request that arrives on port 80?

<details> <summary>Show answer</summary>

HTTP uses port 80, and HTTPS uses port 443. A modern site answers a request on port 80 with a 301 redirect to the https:// address. It can also send an HSTS header, so the browser uses HTTPS for that site every time from then on.

</details>

5. An employee visits a website over HTTPS on the company network. What can the network still see, and what can it not see?

<details> <summary>Show answer</summary>

It can see the domain name, the IP addresses, the time, and how much data moved. The domain name is visible from the DNS lookup and the start of the TLS handshake. It cannot see the path of each page, the page content, form data, or cookies, because those are encrypted.

</details>