HTTPS

Internet2

Extended_Validation_on_Firefox_89_screenshot

HTTPS_on_Firefox_89_screenshot

Self-signed_certificate_warning_on_Firefox_89_screenshot

HTTPS (Hypertext Transfer Protocol Secure) is an extension of the Hypertext Transfer Protocol (HTTP). It is used for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS), or its predecessor, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.

History

HTTPS was developed by Netscape Communications Corporation to provide authentication and encrypted communication and is widely used in Internet transactions. The protocol was first used in Netscape Navigator in 1994.

Technical Details

HTTPS uses TCP port 443 by default, unlike HTTP which uses port 80. The main motivation for HTTPS is to prevent man-in-the-middle attacks and to ensure the privacy and integrity of the exchanged data. HTTPS achieves this by using public key infrastructure (PKI) to authenticate the server and establish a secure session.

Encryption

The encryption is typically done using Transport Layer Security (TLS), which is a protocol that provides privacy and data integrity between two communicating applications. TLS is the successor to Secure Sockets Layer (SSL).

Certificates

To establish a secure connection, a website must have a digital certificate issued by a trusted certificate authority (CA). This certificate contains the public key and the identity of the website owner, which helps in establishing a secure connection.

Usage

HTTPS is used in various applications where secure communication is required. This includes online banking, e-commerce, and other sensitive transactions. It is also used in webmail and other web-based applications where user data needs to be protected.

Advantages

• **Security**: HTTPS provides a secure channel over an insecure network.
• **Data Integrity**: Data cannot be modified or corrupted during transfer without being detected.
• **Authentication**: Ensures that the website is what it claims to be.

Disadvantages

• **Performance**: The encryption and decryption process can add overhead, potentially slowing down the communication.
• **Cost**: Obtaining and maintaining a digital certificate can be costly.

See Also

• HTTP
• Transport Layer Security
• Secure Sockets Layer
• Public key infrastructure
• Certificate authority
• Man-in-the-middle attack

Related Pages

• HTTP
• Transport Layer Security
• Secure Sockets Layer
• Public key infrastructure
• Certificate authority
• Man-in-the-middle attack