HTTP, HTTPS and SSL/TLS Certifications

In this post I'm going to be explaining HTTP, HTTPS and SSL / TLS. HTTP is the protocol that helps us browse the Internet.

So lets start in 1989 a guy called Tim berners-lee who worked for CERN started development of HTTP. HTTP stands for HyperText Transfer Protocol and is used to exchange our transfer hypertext. HTTP resides on the application layer of the OSI model on layer 7. HTTP is the foundation of data communication for the web and this is how the web works when it comes to delivering webpages. 

Let's dig a little deeper into this protocol it is a TCP / IP based protocol and things such as images tags documents audio and video can all be transmitted through it. HTTP works on a request and response cycle where the client requests a webpage so for example if you browse to Google Daugherty UK you are requesting a web page from the server and the server will deliver you a response. 

HTTP is a stateless protocol what this means is that the server does not have to retain information or status about each user for the duration of multiple requests, however this can be achieved by using hitch or cookies or server-side sessions variables and URL rewriting. 

When a client wants to browse a website the first thing that happens is a request is sent to the server known as a HTTP. Message will be sent to the server and it will prepare a response and send it back. A HTTP message is made of free blocks known as the start line headers and the body. The HTTP message will be different depending on if it's message or a response or a request. 

An example of a request HTTP message is the start line contains the method URI and HTTP version , the headers are named value pairs and there is no body because this is a request. Let's take a look at the start line the method is like a command that is given to the server so the server knows what to do in this case it is get. The two most important ones that you will have likelihood is get and post. The next bits of the message is the URl which stands for Uniform Resource identifier which basically is aware that the server can locate a resource, we next have the version of HTTP the client is using . 

The main issue of HTTP is that it's unencrypted meaning it is insecure at transferring data between your computer and a server it is popular to exploiting the man-in-the-middle attacks and  if you're on a huge TCP connection anyone can put themselves in the middle and snag user names emails passwords in plain text , credit card numbers etc. Which is why it's important that HTTPS is used. 

We will now talk about HTTPS as you now know what HTTP is and also the technical aspects about it. The S in HTTPS stands for secure. Over names given to this protocol are HTTP over TLS , HTTP over SSL and HTTP secure. This protocol was designed to increase privacy on the internet when communicating with websites and sending sensitive data. This made man-in-the-middle attacks increasingly difficult as the data sent was no longer in plaintext, it was used to be found on payment transactions or on banking websites .But now it is now widely used on many web sites such as Google, Facebook, Twitter. 

To secure your website you're going to need to purchase something called an SSL certificate these are relatively inexpensive and most hosting companies will offer them or a location where you can get one. An SSL certificate is like an online identification card , SSL certificates also encrypts any data that is passed through the HTTPS protocol . Now when a client requests data from the server it looks at the SSL certificate which will verify the website's identity with the certificate authority, if everything is good a handshake takes place where an encryption method is decided through SSL known as a secure socket layer. 

Now when data  is sent to and from the client and server it is encrypted and decrypted but if a man-in-the-middle attack takes place this data is encrypted and unreadable.