https (Hypertext Transfer Protocol over Secure Socket Layer) is a URI scheme used to indicate a secure HTTP connection. It is syntactically identical to the http:// scheme normally used for accessing resources using HTTP. Using an https: URL indicates that HTTP is to be used, but with a different default TCP port (443) and an additional encryption/authentication layer between the HTTP and TCP. This system was designed by Netscape Communications Corporation to provide authentication and encrypted communication and is widely used on the World Wide Web for security-sensitive communication such as payment transactions and corporate logons. HTTP (for HyperText Transfer Protocol) is the primary method used to convey information on the World Wide Web. ... Schema of multiple vs. ... HTTP compression is a capability built into both web servers and web browsers, to make better use of available bandwidth. ... HTTP Headers form the core of a HTTP request, and are very important in a HTTP response. ... An ETag (entity tag) is an HTTP response header returned by an HTTP/1. ... This article is about the HTTP state mechanism. ... The referer, or HTTP referer, identifies, from the point of view of an internet webpage or resource, the address of the webpage (commonly the URL, the more generic URI or the i18n updated IRI) of the resource which links to it. ... The following is a list of HTTP response status codes and standard associated phrases, intended to give a short textual description of the status. ... A 404 error is presented to the user. ... In the field of computer networking, a URI scheme is the top level of the Uniform Resource Identifier (URI) naming structure. ... Secure communication describes means by which people can share information with varying degrees of certainty that third parties cannot know what was said. ... HTTP (for HyperText Transfer Protocol) is the primary method used to convey information on the World Wide Web. ... Hypertext Transfer Protocol (HTTP) is a communications protocol used to transfer or convey information on intranets and the World Wide Web. ... // Uniform Resource Locator (URL) formerly known as Universal Resource Locator, is a technical, Web-related term used in two distinct meanings: In popular usage and many technical documents, it is a synonym for Uniform Resource Identifier (URI); Strictly, the idea of a uniform syntax for global identifiers of network-retrievable... The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ... Encrypt redirects here. ... For other uses of the terms authentication, authentic and authenticity, see authenticity. ... The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ... Netscape Communications Corporation was the publisher of the Netscape Navigator web browser as well as many other internet and intranet client and server software products. ... For other uses of the terms authentication, authentic and authenticity, see authenticity. ... Encrypt redirects here. ... The World Wide Web and WWW redirect here. ...

How it works

For more details on this topic, see Transport Layer Security#How it works.

Strictly speaking, https is not a separate protocol, but refers to the combination of a normal HTTP interaction over an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection. This ensures reasonable protection from eavesdroppers and man-in-the-middle attacks. Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide secure communications on the Internet for such things as web browsing, e-mail, Internet faxing, instant messaging and other data transfers. ... HTTP (for HyperText Transfer Protocol) is the primary method used to convey information on the World Wide Web. ... Encrypt redirects here. ... Secure Sockets Layer (SSL) and Transport Layer Security (TLS), its successor, are cryptographic protocols which provide secure communications on the Internet. ... Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide secure communications on the Internet for such things as web browsing, e-mail, Internet faxing, instant messaging and other data transfers. ... It has been suggested that Mafia Fraud Attack be merged into this article or section. ...

An https: URL may specify a TCP port; if it does not, the connection uses port 443 (unsecured HTTP typically uses port 80). The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ... It has been suggested that this article or section be merged with Port numbers. ...

To prepare a web-server for accepting https connections the administrator must create a public key certificate for the web-server. These certificates can be created for Unix based servers with tool(s) such as OpenSSL's ssl-ca ^[1] or SuSE's gensslcert. This certificate must be signed by a certificate authority of one form or another, which certifies that the certificate holder is indeed the entity it claims to be. Web browsers are generally distributed with the signing certificates of major certificate authorities, so that they can verify certificates signed by them. In cryptography, a public key certificate (or identity certificate) is an electronic document which incorporates a digital signature to bind together a public key with an identity — information such as the name of a person or an organization, their address, and so forth. ... Filiation of Unix and Unix-like systems Unix (officially trademarked as UNIX®, sometimes also written as or ® with small caps) is a computer operating system originally developed in 1969 by a group of AT&T employees at Bell Labs including Ken Thompson, Dennis Ritchie and Douglas McIlroy. ... OpenSSL is an open source implementation of the SSL and TLS protocols. ... SUSE (properly pronounced , but often pronounced /suzi/) is a major retail Linux distribution, produced in Germany. ... In cryptography, a certificate authority or certification authority (CA) is an entity which issues digital certificates for use by other parties. ... In cryptography and computer security, a root certificate is an unsigned public key certificate, or a self-signed certificate, and is part of a PKI scheme. ...

Organizations may also run their own certificate authority, particularly if they are responsible for setting up browsers to access their own sites (for example, sites on a company intranet), as they can trivially add their own signing certificate to those shipped with the browser.

Some sites, especially those operated by hobbyists, use self-signed certificates on public sites. Using these provides protection against simple eavesdropping, but unlike a well-known certificate, preventing a man-in-the-middle attack with a self-signed certificate requires the site to make available some other secure method of verifying the certificate. In cryptography and computer security, a self-signed certificate is an identity certificate that is signed by its own subject. ... It has been suggested that Mafia Fraud Attack be merged into this article or section. ...

The system can also be used for client authentication, in order to restrict access to a Web server to only authorized users. For this, typically the site administrator creates certificates for each user which are loaded into their browser. These normally contain the name and e-mail address of the authorized user, and are automatically checked by the server on each reconnect to verify the user's identity, potentially without ever entering a password. For other uses of the terms authentication, authentic and authenticity, see authenticity. ...

Limitations

The level of protection depends on the correctness of the implementation by the web browser and the server software and the actual cryptographic algorithms supported. Look up Implementation in Wiktionary, the free dictionary. ... An example of a Web browser (Mozilla Firefox) A web browser is a software application that enables a user to display and interact with text, images, videos, music and other information typically located on a Web page at a website on the World Wide Web or a local area network. ... This article is about algorithms for encryption and decryption. ...

https only protects data in transit from eavesdropping and man-in-the-middle attacks. Once data arrive at their destination, they are only as safe as the computer they are on. Gene Spafford states that it is like "using an armored truck to transport rolls of pennies between someone on a park bench and someone doing business from a cardboard box."^[2] Eugene H. Spafford (born 1956) (known colloquially as Spaf) is a professor of computer science at Purdue University and a leading computer security expert. ...

Because SSL operates below http and has no knowledge of higher level protocols, SSL servers can only present one certificate for a particular IP/port combination. This means that in most cases it is not feasible to use name-based virtual hosting with https. RFC-3546 TLS Extensions describes a solution called Server Name Indication (SNI), although support for is recent (Opera 8, Mozilla 1.8, Internet Explorer 7 on Windows Vista, ...).^[3][4] Secure Sockets Layer (SSL) and Transport Layer Security (TLS), its successor, are cryptographic protocols which provide secure communications on the Internet. ... It has been suggested that this article or section be merged into shared web hosting service. ... Opera is a web browser and Internet suite developed by the Norwegian Opera Software company. ... Mozilla was the official, public, original name of Mozilla Application Suite by the Mozilla Foundation, nowadays called SeaMonkey suite. ... Windows Internet Explorer 7, commonly abbreviated IE7, is a web browser released by Microsoft in late 2006 for Windows Vista, Windows XP and Windows Server 2003. ... Windows Vista is a line of graphical operating systems used on personal computers, including home and business desktops, notebook computers, Tablet PCs, and media centers. ...

References

See also

• Computer security
• AAA protocol
• List of file transfer protocols
• Secure hypertext transfer protocol, an alternative to https that is not widely supported (defined in RFC 2660)

This article describes how security can be achieved through design and engineering. ... In computer security, AAA stands for “authentication, authorization and accounting”. Authentication  Authentication refers to the confirmation that a user who is requesting services is a valid user of the network services requested. ... A protocol for file transfer or file transfer protocol is a convention or standard that controls or enables the transfer of files between two computing endpoints. ... Secure hypertext transfer protocol (S-HTTP) is an alternative mechanism to the https URI scheme for encrypting web communications carried over HTTP. S-HTTP is defined in RFC 2660. ...

External links

• Netscape’s SSL 3.0 Specification
• Apache-SSL homepage (No longer actively developed)
• Apache 2.2 mod_ssl documentation
• RFC 2818 - HTTP Over TLS
• HTTPS Protocol in Internet Explorer Development - MSDN
• Manually Configuring Windows Communication Foundation (WCF) when using HTTP and HTTPS - MSDN
• HTTPS Security Improvements in Internet Explorer 7 & its Compatibility Impact - MSDN