What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is a secure version of the HTTP protocol that uses the SSL/TLS protocol for encryption and authentication. HTTPS is specified by RFC 2818 (May 2000) and uses port 443 by default instead of HTTP’s port 80.

The HTTPS protocol makes it possible for website users to transmit sensitive data such as credit card numbers, banking information, and login credentials securely over the internet. For this reason, HTTPS is especially important for securing online activities such as shopping, banking, and remote work. However, HTTPS is quickly becoming the standard protocol for all websites, whether or not they exchange sensitive data with users.

HTTPS adds encryption, authentication, and integrity to the HTTP protocol:

Encryption: Because HTTP was originally designed as a clear text protocol, it is vulnerable to eavesdropping and man in the middle attacks. By including SSL/TLS encryption, HTTPS prevents data sent over the internet from being intercepted and read by a third party. Through public-key cryptography and the SSL/TLS handshake, an encrypted communication session can be securely set up between two parties who have never met in person (e.g. a web server and browser) via the creation of a shared secret key.

Authentication: Unlike HTTP, HTTPS includes robust authentication via the SSL/TLS protocol. A website’s SSL/TLS certificate includes a public key that a web browser can use to confirm that documents sent by the server (such as HTML pages) have been digitally signed by someone in possession of the corresponding private key. If the server’s certificate has been signed by a publicly trusted certificate authority (CA), such as SSL.com, the browser will accept that any identifying information included in the certificate has been validated by a trusted third party.

HTTPS websites can also be configured for mutual authentication, in which a web browser presents a client certificate identifying the user. Mutual authentication is useful for situations such as remote work, where it is desirable to include multi-factor authentication, reducing the risk of phishing or other attacks involving credential theft. For more information on configuring client certificates in web browsers, please read this how-to.

Integrity: Each document (such as a web page, image, or JavaScript file) sent to a browser by an HTTPS web server includes a digital signature that a web browser can use to determine that the document has not been altered by a third party or otherwise corrupted while in transit. The server calculates a cryptographic hash of the document’s contents, included with its digital certificate, which the browser can independently calculate to prove that the document’s integrity is intact.

Taken together, these guarantees of encryption, authentication, and integrity make HTTPS a much safer protocol for browsing and conducting business on the web than HTTP.

CAs use three basic validation methods when issuing digital certificates. The validation method used determines the information that will be included in a website’s SSL/TLS certificate:

• Domain Validation (DV) simply confirms that the domain name covered by the certificate is under the control of the entity that requested the certificate.
• Organization / Individual Validation (OV/IV) certificates include the validated name of a business or other organization (OV), or an individual person (IV).
• Extended Validation (EV) certificates represent the highest standard in internet trust, and require the most effort by the CA to validate. EV certificates are only issued to businesses and other registered organizations, not to individuals, and include the validated name of that organization.

For more information on viewing the contents of a website’s digital certificate, please read our article, How can I check if a website is run by a legitimate business?

There are multiple good reasons to use HTTPS on your website, and to insist on HTTPS when browsing, shopping, and working on the web as a user:

Integrity and Authentication: Through encryption and authentication, HTTPS protects the integrity of communication between a website and a user’s browsers. Your users will know that the data sent from your web server has not been intercepted and/or altered by a third party in transit. And, if you’ve made the extra investment in EV or OV certificates, they will also be able to tell that the information really came from your business or organization.

Privacy: Of course no one wants intruders scooping up their credit card numbers and passwords while they shop or bank online, and HTTPS is great for preventing that. But would you really want everything else you see and do on the web to be an open book for anyone who feels like snooping (including governments, employers, or someone building a profile to de-anonymize your online activities)? HTTPS plays an important role here too.

User Experience: Recent changes to browser UI have resulted in HTTP sites being flagged as insecure. Do you want your customers’ browsers to tell them that your website is “Not Secure” or show them a crossed-out lock when they visit it? Of course not!

Compatibility: Current browser changes are pushing HTTP ever closer to incompatibility. Mozilla Firefox recently announced an optional HTTPS-only mode, while Google Chrome is steadily moving to block mixed content (HTTP resources linked to HTTPS pages). When viewed together with browser warnings of “insecurity” for HTTP websites, it’s easy to see that the writing is on the wall for HTTP. In 2020, all current major browsers and mobile devices support HTTPS, so you won’t lose users by switching from HTTP.

SEO: Search engines (including Google) use HTTPS as a ranking signal when generating search results. Therefore, website owners can get an easy SEO boost just by configuring their web servers to use HTTPS rather than HTTP.

In short, there are no longer any good reasons for public websites to continue to support HTTP. Even the United States government is on board!

HTTPS adds encryption to the HTTP protocol by wrapping HTTP inside the SSL/TLS protocol (which is why SSL is called a tunneling protocol), so that all messages are encrypted in both directions between two networked computers (e.g. a client and web server). Although an eavesdropper can still potentially access IP addresses, port numbers, domain names, the amount of information exchanged, and the duration of a session, all of the actual data exchanged are securely encrypted by SSL/TLS, including:

• Request URL (which web page was requested by the client)
• Website content
• Query parameters
• Headers
• Cookies

HTTPS also uses the SSL/TLS protocol for authentication. SSL/TLS uses digital documents known as X.509 certificates to bind cryptographic key pairs to the identities of entities such as websites, individuals, and companies. Each key pair includes a private key, which is kept secure, and a public key, which can be widely distributed. Anyone with the public key can use it to:

• Send a message that only the possessor of the private key can decrypt.
• Confirm that a message has been digitally signed by its corresponding private key.

If the certificate presented by an HTTPS website has been signed by a publicly trusted certificate authority (CA), such as SSL.com, users can be assured that the identity of the website has been validated by a trusted and rigorously-audited third party.

In 2020, websites that do not use HTTPS or serve mixed content (serving resources like images via HTTP from HTTPS pages) are subject to browser security warnings and errors. Furthermore, these websites unnecessarily compromise their users’ privacy and security, and are not preferred by search engine algorithms. Therefore, HTTP and mixed-content websites can expect more browser warnings and errors, lower user trust and poorer SEO than if they had enabled HTTPS.

An HTTPS URL begins with https:// instead of http://. Modern web browsers also indicate that a user is visiting a secure HTTPS website by displaying a closed padlock symbol to the left of the URL:

In modern browsers like Chrome, Firefox, and Safari, users can click the lock to see if an HTTPS website’s digital certificate includes identifying information about its owner.

To protect a public-facing website with HTTPS, it is necessary to install an SSL/TLS certificate signed by a publicly trusted certificate authority (CA) on your web server. SSL.com’s knowledgebase includes many helpful guides and how-tos for configuring a wide variety of web server platforms to support HTTPS.

For more general guides to HTTP server configuration and troubleshooting, please read SSL/TLS Best Practices for 2020 and Troubleshooting SSL/TLS Browser Errors and Warnings.