How does HTTPS work?

HTTPS (Hypertext Transfer Protocol Secure) is a protocol that ensures secure data transfer between a client (e.g., a browser) and a server. It is based on HTTP but uses encryption to protect transmitted information.

HTTPS operates on the TLS (Transport Layer Security) protocol, formerly known as SSL (Secure Sockets Layer). TLS/SSL provides three key security aspects:

1. Encryption: Data between the client and server is encrypted, making it unreadable to third parties.
2. Data Integrity: It is verified that data has not been altered during transmission.
3. Authentication: The server confirms its authenticity to the client.

The process of establishing an HTTPS connection involves several steps called the "TLS/SSL Handshake":

1. Client Hello: The client sends a "Client Hello" to the server, containing:
   • The TLS version it supports.
   • A list of supported cipher suites.
   • A random number.
2. Server Hello: The server responds with "Server Hello", choosing from the options offered by the client:
   • The TLS version.
   • One of the cipher suites.
   • A random number.
   • The server's certificate.
3. Certificate: The client receives the server's certificate and verifies its authenticity:
   • Checks the digital signature of the certificate using the public key of the certificate authority (CA).
   • Checks the validity period of the certificate.
   • Checks if the domain name in the certificate matches the one it is connecting to.
4. Client Key Exchange: The client generates a pre-master secret (key), encrypts it with the server's public key from the certificate, and sends it to the server.
5. Change Cipher Spec (Client): The client notifies the server that it is ready to start exchanging encrypted data.
6. Finished (Client): The client sends an encrypted message with a hash of all previous handshake messages to verify integrity.
7. Change Cipher Spec (Server): The server decrypts the pre-master secret using its private key and generates symmetric keys for session encryption. It then notifies the client that it is ready to start exchanging encrypted data.
8. Finished (Server): The server sends an encrypted message with a hash of all previous handshake messages.
9. Encrypted Data Transfer: After the handshake is successfully completed, the client and server use the generated symmetric keys for symmetric encryption of all subsequent data.

Thus, HTTPS provides a secure communication channel, making web browsing safer.