WHAT IS HTTPS AND HOW DOES IT WORK IN THE BACKGROUND?

While using the internet in daily life, you may have noticed the green padlock and the letters “HTTPS” in the address bar. But what does this mean? It is what prevents our passwords, credit card information, and other data from being intercepted or altered by attackers while our computer communicates with a server. HTTPS ensures secure communication by encrypting data between the client and the server. In this article, we will examine what HTTPS is and how it works in detail.

What is HTTPS?

HTTPS (HyperText Transfer Protocol Secure) is the secure version of HTTP. Its main purpose is to encrypt the data flow between the user and the web server, preventing third parties from interfering. HTTPS is secured by adding an encryption layer to HTTP, which is based on SSL/TLS protocols.

SSL and TLS

SSL (Secure Sockets Layer) was a widely used security protocol in the past; however, it has been replaced by the more secure TLS (Transport Layer Security). Although the term “SSL Certificate” is still commonly used today, modern websites are actually protected by the TLS protocol.

Benefits of HTTPS
• Privacy: Encrypts user connections to prevent unauthorized third-party tracking via metadata and cookies.
• Integrity: Prevents third parties from altering data between the website and the user.
• Authentication: Ensures that users are accessing the site they intend to visit, protecting against man-in-the-middle (MITM) attacks.

How Does HTTPS Work?

Before understanding HTTPS, it is useful to examine the basic working principles of HTTP. HTTP is an asynchronous request-response protocol between the client (browser) and the server.
• When a user wants to access a website, the browser sends a request to the server.
• The server responds by sending the requested page and files to the browser. • Since data is unencrypted during this process, malicious individuals can intercept it.

Therefore, HTTPS is necessary for secure transmission.

How Does HTTPS Work in the Background?

Understanding HTTPS in depth is a broad topic, so we will break it down into sections.
• HTTPS uses private (secret) and public keys for encryption management.
• Public Key: Used for encryption.
• Private Key: Used for decryption.

The HTTPS working principle begins when the user securely requests access to a web server. The server sends its certificate along with its public key. The browser checks whether the server’s certificate is trustworthy and generates a random symmetric encryption key. Then, it encrypts this symmetric key using the server’s public key and sends it to the server. The server decrypts the received message using its private key to obtain the symmetric key. Afterward, the server uses this symmetric key to send encrypted data to the user. Finally, the browser decrypts the received data using the symmetric key, ensuring secure webpage access.

HTTPS operates on a client-server structure. It defines how clients (browsers) access web pages from servers and how servers transmit these pages to clients. In this structure:
• Clients are usually browsers running on our computers.
• Servers are computers running programs that remain active.
• Browsers send HTTPS requests to web servers, and servers respond with HTTPS replies.

HTTPS uses both asymmetric and symmetric encryption methods to secure data between the client and server.

Basic Process

1. Initial Connection Establishment
   • When a user tries to access a site that uses HTTPS, the browser sends a request to the server.
   • The server responds with its digital certificate (SSL/TLS Certificate) and public key.

2. Certificate Verification
   • The browser checks whether the certificate was issued by a trusted Certificate Authority (CA).
   • If the certificate is not trustworthy, the user is shown a “This site is not secure” warning.

3. Key Exchange and Encryption
   • The browser generates a random symmetric encryption key.
   • This key is encrypted using the server’s public key and sent to the server.
   • The server decrypts this data using its private key and obtains the same symmetric key.

4. Secure Data Transmission
   • Once both the client (browser) and server share the same symmetric key, all data transmission continues in encrypted form.
   • This method ensures that even if data is intercepted by malicious individuals, it remains unreadable.

Step-by-Step HTTPS Connection Process

1. Client Hello: The browser sends a message containing the encryption algorithms it supports.
2. Server Hello: The server selects an appropriate encryption algorithm and sends its certificate to the browser.
3. Certificate Verification: The browser checks whether the certificate is trustworthy.
4. Key Exchange: The browser generates a random encryption key and encrypts it with the server’s public key.
5. Encrypted Communication Begins: The server decrypts the encrypted key and starts using symmetric encryption for data transmission.

Why Should We Use HTTPS?
• Ensures data security: Prevents user information from being stolen or altered.
• Provides authentication: Protects against fake websites and phishing attacks.
• SEO Advantage: Google ranks HTTPS-enabled sites higher to enhance user security.
• Modern Browsers: HTTP sites may be marked as “Not Secure”, while HTTPS is considered trustworthy.

Conclusion

HTTPS is a critical protocol for data security on the internet. Websites should use HTTPS to protect user information and ensure data integrity. Especially for online services, HTTPS has become a necessity.