HTTP and HTTPS

Similarities between HTTP and HTTPS

For the most part, HTTP and HTTPS are the same because they both use the same underlying protocol, as an HTTP or HTTPS client—a browser—sets up a connection to a specified port on a web server. When the server receives a request, it returns a status code and a message. The response may be the request message, or an error message indicating that something went wrong. The system uses the Uniform Resource Locator URI pattern so resources can be uniquely specified. The only difference between HTTPS and HTTP is the description of a protocol header (https), and the others are the same.

Differences between HTTP and HTTPS

1. HTTP URLs start with http:// and HTTPS URLs start with https://
2. HTTP is insecure while HTTPS is secure
3. The standard port for HTTP is 80, while the standard port for HTTPS is 443
4. In the OSI network model, HTTP works at the application layer, while HTTPS works at the transport layer
5. HTTP does not require encryption, while HTTPS encrypts the transmitted data
6. HTTP does not require a certificate, while HTTPS requires an authentication certificate

How does HTTPS work?

When connecting using HTTPS, the server requires a public key and a signed certificate.

When using an https connection, the server responds to the initial connection with the encryption methods it supports. In response, the client selects a connection method, and the client and server exchange certificates to authenticate each other. Once done, transfer the encrypted information making sure to use the same key, then close the connection. In order to provide https connection support, the server must have a public key certificate that contains key information certified by a certificate authority. Most certificates are authorized by a third-party authority to ensure that the certificate is secure.

In other words, HTTPS is the same as HTTP, but with the addition of  SSL .

HTTP includes the following actions:

1. The browser opens a TCP connection
2. Browser sends HTTP request to server
3. The server sends an HTTP response to the browser
4. TCP connection closed

SSL includes the following actions:

1. Authenticate server side
2. Allows client and server to choose encryption algorithms and ciphers, ensuring both sides support
3. Authenticate the client (optional)
4. Use public key cryptography to generate shared encrypted data
5. Create an encrypted SSL connection
6. Pass HTTP requests over this SSL connection

When should I use HTTPS?

Banking websites, payment gateways, shopping websites, landing pages, emails, and some corporate sector websites should use HTTPS, such as:

• PayPal: https://www.paypal.com
• Google AdSense: https://www.google.com/adsense/

If a website asks you to fill in your credit card information, first you need to check whether the page is using https encrypted connection, if not, then please do not enter any sensitive information such as credit card number.

browser integration

Most browsers will display a warning message when they receive an invalid certificate, and some older browsers will pop up a dialog box that allows the user to choose whether to continue browsing. New browsers typically display a banner warning message across the entire window, while displaying the site's security information in the address bar. Most browsers will prompt a warning if a website contains a mix of encrypted and non-encrypted content.