Secure Sockets Layer (SSL) is the most widely used technology for providing a secure communication between a web client and web server. Most of us are familiar with sites such as Gmail and Yahoo using https protocol in their login pages. When we see this, we may wonder about the difference between http and https. Simply put, HTTP protocol is used for standard communication between a web server and client, while HTTPS is used for a SECURE communication.
What exactly is Secure Communication ?
Suppose there exists two communication parties, A (client) and B (server).
The Workings of HTTP
When A sends a message to B, the message is sent as a plain text in an unencrypted manner. This is acceptable in normal situations where the messages exchanged are not confidential. But imagine a situation where A sends a PASSWORD to B. In this case, the password is also sent as a plain text. This poses a serious security problem; if an intruder (hacker) can gain unauthorized access to the ongoing communication between A and B , he can see the PASSWORDS, as they remain unencrypted. This scenario is illustrated using the following figure
The Workings of HTTPS
When A sends a PASSWORD (say “mypass“) to B, the message is sent in an encrypted format. The encrypted message is decrypted on B’s side. So even if the Hacker gains unauthorized access to the ongoing communication between A and B, he gets only the encrypted password (”xz54p6kd“) and not the original password. This is shown below
How is HTTPS implemented?
HTTPS is implemented using Secure Sockets Layer (SSL). A website can implement HTTPS by purchasing an SSL Certificate. Secure Sockets Layer (SSL) technology protects a website and allows visitors to trust the site with their personal information. It has the following uses:
- An SSL Certificate enables encryption of sensitive information during online transactions.
- Each SSL Certificate contains unique, authenticated information about the certificate owner.
- A Certificate Authority verifies the identity of the certificate owner when it is issued.
How Encryption Works
Each SSL Certificate consists of a Public key and a Private key. The public key is used to encrypt the information and the private key is used to decrypt it. When your browser connects to a secure domain, the server sends a public key to the browser to perform the encryption. The public key is made available to everyone, but the private key (used for decryption) is kept secret. During a secure communication, the browser encrypts the message using the public key and sends it to the server. The message is decrypted on the server side using the private key.
How to identify a secure connection
In Internet Explorer, you will see a lock icon in the Security Status bar. The Security Status bar is located on the right side of the address bar. You can click the lock to view the identity of the website.
In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns GREEN when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning and the status bar may turn RED.
So the bottom line is, whenever you perform an online transaction such as credit card payment, bank login, or email login always ensure that you have a secure communication. A secure communication is a must in these situations to avoid phishing.