HTTP - HTTP over TLS(HTTPS)

HTTP protocol is used to transfer data over the web. It is a stateless protocol, which means that each command is executed independently, without knowledge of the commands that executed before it. It makes it unfit for transferring sensitive data. When HTTP is combined with TLS (Transport Layer Security), it becomes HTTPS which can be used to transfer sensitive data over the web as it is secure because it uses encryption to keep the data private.

TLS is a cryptographic protocol which is used to provide secure communication over a computer network. It is the successor of Secure Sockets Layer (SSL) protocol. TLS addresses vulnerabilities of SSL while providing enhanced security features. TLS is widely used to encrypt data exchanged between clients and servers.

Why We Need HTTPS?

We need HTTP for following reasons mentioned below:

• Confidentiality: HTTPS keeps our data confidential as it encrypts the data exchanged between client and the server.
• Data Integrity: HTTPS ensures that the shared data between client and server is not tampered during the transmission of data. If the data us tempered then it is detected, which prevents man-in-the-middle (MITM) attacks.
• Authentication: HTTPS uses digital certificates to verify the identity of the server, issued by trusted Certificate Authorities (CAs). This ensures that users are communicating with the intended website and not an imposter.

Components of HTTPS

The key components of HTTPS are mentioned below:

• TLS Protocol: It is the protocol that provides encryption and secure communication.
• Digital Certificates: Digital files issued by CA that bind a public key to an organization's identity.
• Keys: Two types of keys are used - Public and Private Keys. Public Key encrypts the data and verify signatures whereas Private Key decrypts the data and sign certificates.

How HTTPS Works?

HTTPS uses process known as TLS handshake. It establishes a secure session between client and the server. The working of HTTPS is mentioned below:

• The client sends a message with supported encryption algorithms and a randomly generated number.
• The server then responds with its chosen encryption algorithms along with its own random number, and its digital certificate.
• The client uses the public key of the CA that issued the digital certificate to verify the server's certificate .
• A shared secret key is established using asymmetric encryption such as RSA or Diffie-Hellman for secure communication.
• On completion of handshake, both the client and server uses the shared secret key to encrypt and decrypt data.

Setting up HTTPS

To enable HTTPS on a website, first we obtain a TLS/SSL certificate and then configure the web server to use it. The steps for setting up HTTPS is mentioned below:

• First we choose a trusted CA such as Let's Encrypt.
• Then generate a Certificate Signing Request (CSR) containing your domain name and organization details.
• Then submit the CSR to CA, where CA verifies ownership of domain and issue the certificate.
• Then install the certificate by uploading the certificate to Your server along with any intermediate certificates provided by the CA.
• For configuring Web Server, modify server configuration files such as httpd.conf for Apache or nginx.conf for Nginx to enable HTTPS and point to the certificate and private key files.
• Set up redirect rules to redirect HTTP requests to HTTPS automatically and update internal links and resources to use HTTPS URLs.
• Tools like SSL Labs' SSL Test can be used to ensure proper installation.
• Make sure all your resources are loaded over HTTPS to avoid browser warnings.

Benefits of HTTPS

• HTTPS encrypts sensitive information, protecting it from interception enhancing the security.
• Search engines like Google give preference to HTTPS-enabled websites in rankings affecting the SEO of webpage.
• It improves performance by offering faster handshakes and reduced latency.
• It maintains the integrity of data as it prevents data from being altered or corrupted during transmission.
• It displays a padlock icon and secure label in the browser's address bar, indicating that the website is trustworthy.

Best Practices for HTTPS

• Use strong cipher suites and make sure your server supports modern, secure cipher suites.
• Use tools to monitor certificate expiry and scan for vulnerabilities.
• Use HTTP Strict Transport Security(HSTS) to enforce HTTPS connections and prevent protocol downgrade attacks.
• Disable outdated protocols like SSL 3.0 and TLS 1.0.
• Keep certificates up to date to avoid service disruptions.