[Study notes] HTTP & HTTPS…

HTTP & HTTPS are Protocols used for transferring data between the browser and websites.

Protocols are like a set of rules for communication to allow devices to send, receive, and interpret data across networks.

HTTP (HyperText Transfer Protocol)

The most basic Protocol which uses plain text to send data without any encryption. Therefore, there is a risk of interception while data is being transferred. Meaning, anyone intercepting the connection can read or edit the data.

HTTPS (HyperText Transfer Protocol Secure)

To enhance the security of transferring plain text (HTTP), a secure version of HTTP was introduced, which is HTTPS (s for secure).

Get Giwon’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Right after the TCP 3 way handshake is established (HTTP Protocol), the TSL (Transport Layer Security) connection begins

TSL (Transport Layer Security)

The goal of TSL is to provide encryption (no one can read the data), integrity (no one can edit the data), and authentication (is an existing website). All this happens through another multi-step handshake process called the TSL handshake, after the TCP 3 way handshake.

TSL Handshake

1. The Greeting: The client (browser) and server exchange “Hellos” and checks which version of TSL and which Cipher Suite (set of algorithms) they will use to encrypt the data.
2. Server Certificate Check: The server sends its SSL/TSL Certificate. This contains the server’s Public Key. The browser uses the Public key provided and checks it with a listed of trusted Certificate Authorities (CAs) to make sure the server is NOT an impostor.
3. Key Exchange: Using the Public Key, the Client and Server come to an agreement on a “Session Key”.
4. After the Session Key — Encryption: Once the Session key is created, Both the Client and Server send a “Finished Message”. After this point, any data sent is encrypted using Symmetric Encryption.

HTTP Request

After the TSL handshake is established, finally, HTTP requests can be made between client and server.