The Difference Between HTTP and HTTPS
Category Programming Technology
Basic Concepts
HTTP (HyperText Transfer Protocol) is an application layer protocol used for distributed, collaborative, and hypermedia information systems. In simple terms, it is a method for publishing and receiving HTML pages, used to transfer information between web browsers and website servers.
HTTP operates by default on TCP port 80, and any website accessed with http://
at the beginning is a standard HTTP service.
The HTTP protocol sends content in plaintext without any form of data encryption. If an attacker intercepts the transmission between the web browser and the website server, they can directly understand the information. Therefore, the HTTP protocol is not suitable for transmitting sensitive information, such as credit card numbers, passwords, and other payment information.
HTTPS (Hypertext Transfer Protocol Secure) is a transmission protocol for secure communication over computer networks. HTTPS communicates through HTTP but uses SSL/TLS to encrypt data packets. The main purpose of developing HTTPS is to provide identity authentication for website servers and to protect the privacy and integrity of the exchanged data.
HTTPS operates by default on TCP port 443, and its workflow generally follows this pattern:
- TCP three-way handshake
- Client verifies the server's digital certificate
- DH algorithm negotiates the symmetric encryption algorithm key, hash algorithm key
- SSL secure encryption tunnel negotiation is completed
- The web page is transmitted in an encrypted manner, encrypted with the negotiated symmetric encryption algorithm and key to ensure data confidentiality; the negotiated hash algorithm is used for data integrity protection to ensure that the data is not tampered with.
>
As of June 2018, 34.6% of the top 1 million websites ranked by Alexa use HTTPS as the default, 43.1% of the 141,387 most popular websites on the Internet have securely implemented HTTPS, and 45% of page loads (recorded by Firefox) use HTTPS. In March 2017, 0.11% of the total number of registered domain names in China used HTTPS.
According to Mozilla statistics, since January 2017, more than half of website traffic has been encrypted.
Differences Between HTTP and HTTPS
HTTP transmits data in plaintext, which is unencrypted and less secure. HTTPS (SSL+HTTP) encrypts the data transmission process, which is more secure.
Using the HTTPS protocol requires applying for a certificate from a CA (Certificate Authority). Generally, there are fewer free certificates, so there is a certain cost. Certificate issuing authorities include Symantec, Comodo, GoDaddy, and GlobalSign, among others.
HTTP pages respond faster than HTTPS, mainly because HTTP uses TCP's three-way handshake to establish a connection, requiring the client and server to exchange 3 packets. In contrast, HTTPS, in addition to TCP's three packets, also requires 9 packets for SSL handshaking, totaling 12 packets.
HTTP and HTTPS use completely different connection methods and different ports. The former is 80, and the latter is 443.
HTTPS is essentially the HTTP protocol built on top of SSL/TLS, so it is more resource-intensive for the server compared to HTTP.
TCP Three-Way Handshake
First handshake: The client attempts to connect to the server by sending a SYN packet (Synchronize Sequence Numbers) to the server, with syn=j. The client enters the SYN_SEND state, waiting for server confirmation.
Second handshake: The server receives the client's SYN packet and confirms it (ack=j+1), and at the same time, sends a SYN packet (syn=k) to the client, which is a SYN+ACK packet. The server then enters the SYN_RECV state.
Third handshake: The client receives the server's SYN+ACK packet and sends an ACK packet (ack=k+1) to the server. Once this packet is sent, the client and server enter the ESTABLISHED state, completing the three-way handshake.
Simplified:
Working Principle of HTTPS
We all know that HTTPS can encrypt information to prevent sensitive information from being obtained by third parties, so many banks, email services, and other services with higher security levels will adopt the HTTPS protocol.
1. Client initiates HTTPS request
There is nothing special about this; it is simply the user entering an https URL in the browser and then connecting to the server's port 443.
2. Server configuration
Servers using the HTTPS protocol must have a set of digital certificates, which can be self-made or applied for from organizations. The difference is that self-issued certificates require client verification before access can continue, while certificates from trusted companies do not prompt a warning page (startssl is a good choice, offering a 1-year free service).
This set of certificates is essentially a pair of public and private