Lao Li share: HTTPS protocol

Recently we have seen many sites using the HTTPS protocol to provide Web services. Usually we see the HTTPS protocol in some sites that contain confidential information like a bank.

If you visit Google and look at the address bar, you will see the following information

We can see that "https" is highlighted in green, and there is a lock tag in front of it, indicating that the Web request is over the HTTPS protocol.

HTTPS is a version of the HTTP protocol that provides secure data transfer between the browser and the server.

The browser and server communicate over the HTTP protocol, and when using the HTTP protocol, the client submits form data to the service side in a non-encrypted manner.

So when the physical network in which the browser and the server communicates is compromised, the intruder gets the information that is transferred between the Web browser and the server.

The scenario for HTTP is that we do not need to encrypt the data using a high security level method. But applications such as banks send sensitive data like the credit card details class, which creates security threats. If the intruder monitors the communication channel, he can easily get sensitive data to the underlying user.

HTTPS ensures secure and reliable communication

To avoid such security threats, HTTPS came into being. HTTPS is a protocol that ensures that data is securely transported between the Web browser and the Web server.

HTTPS is composed of the HTTP protocol +ssl protocol. The SSL protocol provides security for network communication by encrypting the information. It uses an asymmetric key mechanism, which distributes the public key freely, while the private key is only available to the recipient of the message.

The two main advantages of the HTTPS vs standard HTTP protocol are:

• It ensures that the user is accessing the correct website, which he originally intended to visit rather than a fake website.

• It ensures that the content of the communication between the Web browser and the Web server is encrypted, so the intruder cannot get the original communication content.

So in HTTPS, SSL serves to ensure that the data is secure on both the client and Web server side.

HTTPS Work Flow

To figure out how the Htpps protocol works, we should first understand how the encryption and decryption process works.

Encryption is the conversion of text content into some other format so that others cannot parse the original content.

Decryption is the conversion of the previously converted ciphertext back to the original content.

The encryption and decryption process can also use keys to encrypt and decrypt information. Therefore, if the information is encrypted with a key, then the same key can be used to decrypt it. This approach is called a symmetric key mechanism because the same key is used for encryption and decryption.

If we use a key to encrypt a string and another key to decrypt the string, we call the key an asymmetric key. The key we use to encrypt a string is called the public key, and the key used to decrypt the string is called the private key.

So now we understand that HTTPS is used to securely transfer information between the Web server and the Web browser. This is a very good process to use the HTTPS protocol when transmitting information.

The following procedure also occurs when a browser requests a page with the HTTPS protocol:

1. The browser makes an HTTPS request to the server, and the server listens on port 443, which is the request that Web server uses to listen for the HTTPS protocol.

2. Once the Web browser has successfully established a connection with the Web server, the SSL handshake process begins.

In the handshake process, the browser and the server negotiate the encryption algorithm for the data and answer the agreement. The process is as follows:

• 1. The browser sends some of its own information to the server (such as its supported SSL version);

• 2. The server responds to similar information, such as the SSL version that will be used during the communication process;

• 3. The server sends a certificate to the browser, which contains the public key of the encrypted data, the publisher information, the expiration date and the service-side unique identification;

• 4. The browser verifies the certificate and sends a message informing the server that the certificate has been completed;

• 5. The browser sends the "Changecipher spec" directive to the server: the browser will encrypt the data;

• 6. The server sends a "changecipher spec" instruction to the browser, which encrypts the data being sent.

When we click on the Chrome small lock flag, we can see the digital certificate sent by the server.

3. The browser generates a symmetric key and encrypts it through the server's public key, and then sends the encrypted key to the server. This symmetric key is used to encrypt and decrypt the entire session.

We know that digital certificates are used to provide a public key. There are two key terms used to understand digital certificates.

This is a standard for defining the format of a digital certificate, which specifies what information needs to be included in the certificate, such as the following:

• Version specifies the version of the

• Serial number unique number used to differentiate certificates

• Certificate Publisher name CA

• Public

The CA (certification Authority) represents the authority that publishes the certificate. Certificates can only be obtained from publishers. The certificate usually has the publisher's signature to ensure validity.

Lao Li share: HTTPS protocol