Https

	Email		Print
	Bookmark		Link

Https

Hypertext Transfer Protocol Secure (HTTPS) is a combination of the Hypertext Transfer Protocol

Hypertext Transfer Protocol

Hypertext Transfer Protocol is an application-level protocol for distributed, collaborative, hypermedia information systems. Its use for retrieving inter-linked resources led to the establishment of the World Wide Web....
and a network security

Secure communication

When two entities are communicating with each other, and they do not want a third party to listen to their communication, then they want to pass on their message in such a way that no body else could understand their message....
protocol.

HTTP operates at the highest layer of the TCP/IP Internet reference model, the Application layer; but the security protocol operates at lower sublayer, encrypting an HTTP message prior to transmission and decrypting a message upon arrival.

HTTPS has also been known as "Hypertext Transfer Protocol over Secure Socket Layer", but now HTTPS may be secured by the Transport Layer Security

Transport Layer Security

Transport Layer Security and its predecessor, Secure Sockets Layer , are cryptographic protocols that provide security and data integrity for communications over Internet Protocol Suite networks such as the Internet....
(TLS) instead of Secure Sockets Layer (SSL) protocol.

To invoke HTTPS, one replaces "http://" with "https://" in the URI

URI scheme

In the field of computer networking, a URI scheme is the top level of the Uniform Resource Identifier naming structure. All URIs and absolute URI references are formed with a scheme name, followed by a Colon , and the remainder of the URI called the scheme-specific part....
, or Web address.

HTTPS connections are often used for payment transactions on the Web and for sensitive transactions in corporate information systems.

Function
Strictly speaking, HTTPS is not a separate protocol, but refers to the combination of a normal HTTP interaction over an encrypted

Encryption

In cryptography, encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key ....
Secure Sockets Layer (SSL) or Transport Layer Security

Transport Layer Security

Discussion

Ask a question about 'Https'

Start a new discussion about 'Https'

Answer questions from other users

Full Discussion Forum

Encyclopedia

Hypertext Transfer Protocol Secure (HTTPS) is a combination of the Hypertext Transfer Protocol

Hypertext Transfer Protocol

Secure communication

Transport Layer Security

URI scheme

Function

Strictly speaking, HTTPS is not a separate protocol, but refers to the combination of a normal HTTP interaction over an encrypted

Encryption

Transport Layer Security

Transport Layer Security and its predecessor, Secure Sockets Layer , are cryptographic protocols that provide security and data integrity for communications over Internet Protocol Suite networks such as the Internet....
(TLS) connection. This ensures reasonable protection from eavesdroppers

Eavesdropping

Eavesdropping is the act of surreptitiously listening to a private conversation. This is commonly thought to be unethical and there is an old adage that eavesdroppers seldom hear anything good of themselves....
and man-in-the-middle attack

Man-in-the-middle attack

In cryptography, the man-in-the-middle attack or bucket-brigade attack , sometimes Janus attack, is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection when i...
s, provided that adequate cipher suites are used and that the server certificate is verified and trusted.

An https: URL may specify a TCP

Transmission Control Protocol

The Transmission Control Protocol is one of the core protocols of the Internet Protocol Suite. TCP is so central that the entire suite is often referred to as "TCP/IP"....
port. If it does not, the connection uses port 443 (unsecured HTTP typically uses port 80).

To prepare a Web server to accept HTTPS connections, the administrator must create a public-key certificate

Public key certificate

In cryptography, a public key certificate is an electronic document which incorporates a digital signature to bind together a public key with an identity — information such as the name of a person or an organization, their address, and so forth....
for the Web server. These certificates can be created for Unix

Unix

Unix is a computer operating system originally developed in 1969 by a group of American Telephone & Telegraph employees at Bell Labs, including Ken Thompson , Dennis Ritchie, Douglas McIlroy, and Joe Ossanna....
-based servers with tools such as OpenSSL

OpenSSL

OpenSSL is an open source implementation of the Transport Layer Security protocols. The core library implements the basic cryptography functions and provides various utility functions....
's ssl-ca or SuSE

Suse

Suse may refer to:*SUSE Linux distributions*Sus, Azerbaijan...
's gensslcert. This certificate must be signed by a certificate authority

Certificate authority

In cryptography, a certificate authority or certification authority is an entity which issues Public key certificates for use by other parties....
of one kind or another. The authority certifies that the certificate holder is indeed the entity it claims to be. Web browsers are generally distributed with the signing certificates of major certificate authorities

Root certificate

In cryptography and computer security, a root certificate is either an unsigned public key certificate or a self-signed certificate that identifies the Root Certificate Authority ....
so that they can verify certificates signed by them.

Organizations may also run their own certificate authority, particularly if they are responsible for setting up browsers to access their own sites (for example, sites on a company intranet). They can easily add copies of their own signing certificate to those shipped with the browser.

Some sites, especially those operated by hobbyists, use self-signed certificate

Self-signed certificate

In cryptography and computer security, a self-signed certificate is an identity certificate that is signed by its own creator. That is, the person that created the certificate also signed off on its legitimacy....
s on public sites. Using such certificates provides protection against simple eavesdropping, but the prevention of man-in-the-middle attack

Man-in-the-middle attack

In cryptography, the man-in-the-middle attack or bucket-brigade attack , sometimes Janus attack, is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection when i...
s entails the use of some other secure method of verifying the certificate.

The system can also be used for client authentication

Authentication

Authentication is the act of establishing or confirming something as authentic, that is, that claims made by or about the subject are true....
in order to limit access to a Web server to authorized users. To do this, the site administrator typically creates a certificate for each user, a certificate that is loaded into his/her browser. Normally, that contains the name and e-mail address of the authorized user and is automatically checked by the server on each reconnect to verify the user's identity, potentially without even entering a password.

Limitations

The level of protection depends on the correctness of the implementation

Implementation

Implementation is the realization of an application, or execution of a plan, idea, model, design, specification, Standardization, algorithm, or policy....
by the Web browser

Web browser

A Web browser is a application software which enables a user to display and interact with text, images, videos, music, games and other information typically located on a Web page at a website on the World Wide Web or a local area network....
and the server software and the actual cryptographic algorithm

Cipher

In cryptography, a cipher is an algorithm for performing encryption and decryption — a series of well-defined steps that can be followed as a procedure....
s supported.

Also, HTTPS is unsecured when applied on publicly-available static content. The entire site can be indexed using a Web crawler

Web crawler

A Web crawler is a computer program that browses the World Wide Web in a methodical, automated manner. Other terms for Web crawlers are ants, automatic indexers, bots, and worms or Web spider, Web robot, or?especially in the FOAF community?Web scutter....
, and the URI of the encrypted resource can be inferred by knowing only the intercepted request/response size. This allows an attacker to have access to the plaintext

Plaintext

In cryptography, plaintext is the information which the sender wishes to transmit to the receiver. Before the computer era, plaintext simply meant text in the language of the communicating parties....
(the publicly-available static content), and the encrypted text (the encrypted version of the static content).

Because SSL operates below HTTP and has no knowledge of higher-level protocols, SSL servers can only strictly present one certificate for a particular IP/port combination. This means that, in most cases, it is not feasible to use name-based virtual hosting

Virtual hosting

Virtual hosting is a method that Server s such as web servers use to host more than one domain name on the same computer, sometimes on the same IP address....
with HTTPS. describes a solution called Server Name Indication

Server Name Indication

Server Name Indication is a feature that fixes a flaw in the SSL v2 protocol. It permits the client to request the domain name, before the certificate is committed to by the server....
(SNI), although many older browsers don't support this extension. Support for SNI is available since Firefox 2.0, Opera

Opera (web browser)

Opera is a web browser and Internet suite developed by the Opera Software company. Opera handles common Internet-related tasks such as displaying web sites, sending and receiving e-mail messages, managing contacts, IRC online chatting, downloading files via BitTorrent , and reading web feeds....
8, Mozilla

Mozilla

Mozilla was the official, public, original name of Mozilla Application Suite by the Mozilla Foundation, currently known as SeaMonkey internet suite....
1.8, and Internet Explorer 7

Internet Explorer 7

Windows Internet Explorer 7 is a web browser released by Microsoft in October 2006. Internet Explorer 7 is part of a long line of versions of Internet Explorer and was the first major update to the browser in more than 5 years....
on Windows Vista

Windows Vista

Windows Vista is one member in a family of operating systems developed by Microsoft for use on personal computers, including home and business Desktop computer, laptops, Tablet PCs, and media center PCs....
.

With the newer Internet Explorer 7 browser, Microsoft has increased the warnings sent when certificates are not registered. Whereas previously only a "security advice" pop-up appeared (which differentiated between name, source, and run time of the certificate), now a warning is displayed across the entire window, which recommends not using the Web site. Therefore, a certificate that is not registered in the browser is not usable for mass applications. Certificates that are registered in the root chains cost between US$

United States dollar

The United States dollar is the unit of currency of the United States and was defined by the Coinage Act of 1792 to be between 371 and 416 grains of silver ....
10 and $1,200 per year.

External links

(IETF)
(No longer actively developed)
RFC 2818 - HTTP Over TLS

Https

Function

Limitations

See also

External links