Author: Insist--
Personal homepage: insist--personal homepage
The author will continue to update network knowledge and python basic knowledge , looking forward to your attention
Table of contents
1. The client initiates an HTTPS request
4. The client parses the certificate
6. The server decrypts the information
7. Transmission of encrypted information
8. The client decrypts the information
Fourth, the difference between HTTP and HTTPS
foreword
When you surf the Internet every day, when you search for something, do you find any difference in the URL? This article will talk about the difference between HTTP and HTTPS.
1. What is HTTP?
HTTP is the abbreviation of "HyperText Transfer Protocol". The translation is Hypertext Transfer Protocol, which is an application layer protocol for distributed, collaborative and hypermedia information systems. Simply put, it is a protocol for publishing and receiving HTML pages, which is used to transfer information between web browsers and web servers.
HTTP works on port 80 of the TCP protocol by default , and users access websites starting with http:// are standard HTTP services.
HTTP transmission has the characteristics of simplicity and flexibility , but the disadvantage is that it uses clear text transmission , the request and response will not confirm the communication party, the integrity of the data cannot be protected, and the transmission content is easy to be stolen.
2. What is HTTPS?
HTTPS is the abbreviation of "Hypertext Transfer Protocol Secure", which translates to Hypertext Transfer Protocol Secure . It is a transport protocol for secure communication over a computer network . HTTPS communicates over HTTP, but utilizes SSL/TLS to encrypt packets. The main purpose of HTTPS development is to provide identity authentication for web servers and protect the privacy and integrity of exchanged data.
3. How HTTPS works
After reading the explanation of HTTPS above, everyone knows that HTTPS can encrypt information to prevent important information from being obtained by a third party, so many banking websites or e-mails and other services with a high level of security will use the HTTPS protocol.
1. The client initiates an HTTPS request
This is easy to understand, that is, the user enters an https URL in the browser, and then connects to port 443 of the server.
2. Server configuration
A server using the HTTPS protocol must have a set of digital certificates, which can be made by yourself or applied to the organization
Difference: The certificate issued by itself needs to be verified by the client before you can continue to access, while the certificate applied by a trusted company will not pop up a prompt page.
This set of certificates is actually a pair of public key and private key . If you don’t understand public key and private key, you can think of it as a key and a lock, but you are the only person in the world who has this key. You can lock the lock Give the head to others, others can use this lock to lock important things, and then send it to you, because only you have this key, so only you can see the things locked by this lock.
3. Transmission certificate
This certificate is actually a public key, but it contains a lot of information, such as the issuing authority of the certificate, expiration time and so on.
4. The client parses the certificate
This part of the work is done by the client's TLS . First, it will verify whether the public key is valid, such as the authority, expiration time, etc. If an exception is found, a warning box will pop up, indicating that there is a problem with the certificate.
If there is no problem with the certificate, then generate a random value, and then encrypt the random value with the certificate, as mentioned above, lock the random value with a lock, so that unless there is a key, the locked value cannot be seen content.
5. Send encrypted information
This part transmits the random value encrypted with the certificate. The purpose is to let the server get this random value . In the future, the communication between the client and the server can be encrypted and decrypted through this random value.
6. The server decrypts the information
After decrypting with the private key, the server obtains the random value (private key) sent by the client, and then encrypts the content symmetrically through this value.
Symmetric encryption: The information and private key are mixed together through some algorithm.
In this way, unless the private key is known, the content cannot be obtained, and both the client and the server know the private key, so as long as the encryption algorithm is advanced enough and the private key is complex enough, the data is safe enough.
7. Transmission of encrypted information
This part of information is the information encrypted by the private key of the service segment, which can be restored on the client.
8. The client decrypts the information
The client uses the previously generated private key to decrypt the information sent by the service segment, and then obtains the decrypted content. Even if the third party monitors the data during the whole process, there is nothing they can do.
Fourth, the difference between HTTP and HTTPS
1. Security
HTTP and HTTPS are two different protocols, and the main difference between them is security. The HTTP protocol sends content in plain text, without any form of data encryption, and it is easy for attackers to intercept information.
HTTPS adds , enabling encrypted transmission of messages and ensuring data security.
2. Different port numbers
HTTP and HTTPS use completely different connection methods and use different ports, HTTP is 80, HTTPS is 443.
3. Certificate
HTTPS needs to apply for a certificate, but HTTP does not, and there will be some fees for applying for a certificate.