Tell about the HTTPS protocol.

HTTPS (Hypertext Transfer Protocol Secure) is an extension of the HTTP protocol that provides secure data transmission between the client (browser) and the server.

Main differences and principles of HTTP operation:

Encryption: Uses SSL/TLS protocols to encrypt data, protecting it from interception and alteration.
Integrity: Ensures that data sent by the client arrives at the server unchanged.
Authentication: Allows the client to verify the server's authenticity, ensuring interaction with the correct resource.

Steps to establish a secure connection:

Client Hello: The client sends the server a list of supported SSL/TLS versions, encryption algorithms, and other parameters.
Server Hello: The server selects the most suitable options from those offered by the client and sends them back, along with its certificate.
Certificate Verify: The client verifies the server's certificate (authenticity, validity period, trust chain).
Client Key Exchange: The client generates a session secret key, encrypts it with the server's public key (from the certificate), and sends it to the server.
Server Change Cipher Spec, Finished: The server decrypts the secret key, initiates session encryption, and confirms readiness for encrypted data exchange.
Client Change Cipher Spec, Finished: The client similarly initiates session encryption and confirms readiness.
Secure Data Exchange: Further data exchange occurs using symmetric encryption based on the session secret key.

HTTPS is mandatory for sites handling confidential information (logins, passwords, banking data) and is an important factor for SEO. When testing HTTPS, it is important to check:

Validity and correctness of the SSL certificate.
Support for modern TLS versions.
Presence of vulnerabilities (e.g., Heartbleed, POODLE).
Correct redirects from HTTP to HTTPS.
Mixed content (when resources are loaded over HTTP on an HTTPS page).

Tools used for testing include: Postman, curl, OpenSSL, browser developer tools.

# Checking SSL certificate with OpenSSL
openssl s_client -connect example.com:443

# Example of an HTTPS request using Python requests
import requests

try:
    response = requests.get("https://example.com")
    response.raise_for_status()  # Check for HTTP errors
    print("HTTPS connection successful.")
except requests.exceptions.RequestException as e:
    print(f"Error connecting via HTTPS: {e}")