This article explains the difference Http and https, and how https encryption to ensure security.
First tell the difference between maybe has a simple protocol:
HTTP: Hypertext Transfer Protocol.
HTTPS: Hypertext Transfer Protocol Secure Socket Layer HTTP + SSL
HTTP: client and server-side delivery of the message is plain text.
HTTPS: encrypt the plaintext and then passed before the client and the server.
HTTP port 80, the port 443 using HTTPS.
HTTPS requests the certificate.
HTTPS using symmetric encryption and asymmetric encryption two encryption to protect the security of transmitted information:
Asymmetric encryption: using public and private keys to encrypt and decrypt (some students here do not understand, then you can look at the information).
Symmetric encryption: encryption and decryption keys are set with the same.
Note: Asymmetric encryption is more secure, faster symmetric encryption.
https request process:
-
The client (browser) requests https connection to the server.
-
The server returned certificate (public key) to the client.
-
Client random secret key A (for symmetric encryption).
-
A client to be encrypted with the public key.
-
The client A sends the encrypted cipher text to the server.
-
Server secret key decrypted symmetric encryption by a private key of the ciphertext.
-
Client and server secret symmetric key ciphertext encrypted communication.
In the second step the above-described procedure is risky, because the public key is exposed, when the public key is illegally intercepted by an intermediary, while the public key intermediary replace its public key to the client, to thereby obtain a symmetric encryption secret key, and thus communicate with the client camouflage.
To solve this problem, on the introduction of digital certificates and digital signatures
So in the second step, the server sends an SSL certificate to the client, SSL certificate contains the specific contents of the certificate authority, validity period, a public key, certificate holders, the signature verification by a third party guarantee legal status.
A first client reads the certificate owner, expiration date information for verification.
Second, the client (browser) Find the operating system has built-in certificate issuing authority trusted CA, issued the server certificate sent me CA comparison is used to verify whether the certificate issued by a legitimate institution.
Third, if not, the browser will give an error.
Fourth, if found, will be taken out of the public which, in the signature certificate to decrypt it.
Fifth, use the same Hash algorithm to the signature digest and summary sent to the server for comparison.
Six, if you compare the same, the legal, so you get a public key
A large number of books interview experience and learning materials please pay attention to micro-channel public number: AVAJ
Reply to "offer" be acquired
365 java giant plane by what you want me there