How does the HTTPS protocol work?

HTTPS is an extension of the HTTP protocol with support for data encryption and server authentication using SSL/TLS protocols.

Main steps to establish a secure connection:

1. ClientHello: The client (browser) sends a message to the server containing:

   • Supported SSL/TLS versions.
   • Supported cipher suites, including encryption, hashing, and key exchange algorithms.
   • A random number (client random).

2. ServerHello: The server responds to the client, choosing from the proposed options:

   • SSL/TLS version.
   • Cipher suite.
   • A random number (server random).
   • Server certificate.

3. Certificate exchange: The server sends its digital certificate issued by a Certificate Authority (CA). The certificate contains:

   • Server's public key.
   • Server's domain name.
   • Certificate validity period.
   • CA's digital signature.

4. Certificate verification: The client verifies the server's certificate:

   • Validity period.
   • Domain name match.
   • Trust in CA (root CA certificates are stored in the browser/OS).
   • CA's digital signature using the CA's public key.

5. Pre-Master Secret generation: The client generates a random number (Pre-Master Secret) and encrypts it with the server's public key obtained from the certificate.

6. Encrypted Pre-Master Secret exchange: The client sends the encrypted Pre-Master Secret to the server.

7. Pre-Master Secret decryption: The server decrypts the received Pre-Master Secret using its private key.

8. Master Secret generation: Both client and server generate an identical Master Secret using the Pre-Master Secret and their respective random numbers (client random and server random).

9. Session key generation: Symmetric session keys are generated from the Master Secret, used for encrypting and decrypting data during the session (usually one key for sending and one for receiving on each side).

10. Change Cipher Spec: The client and server notify each other about switching to the generated session keys for further communication.

11. Finished: The client and server send messages encrypted with the new session keys, containing hashes of previous handshake messages. This ensures the handshake was successful and both parties possess the same session keys.

After the handshake, all subsequent data exchange between the client and server occurs encrypted using symmetric session keys.

Comparison of HTTP and HTTPS:

Parameter	HTTP	HTTPS
Security	Data transmitted in plain text	Data is encrypted
Default port	80	443
Certificate	Not required	SSL/TLS certificate required
Cost	Free	Requires purchase or free certificate
Performance	Slightly faster (no encryption)	Slightly slower (encryption required)

Using HTTPS ensures confidentiality, data integrity, and server authentication, protecting against "Man-in-the-Middle" (MITM) attacks.