HTTPS for dummies - so how HTTPS really works in 5 mins

What is HTTPS?

HTTPS (HyperText Transfer Protocol Secure) is a way of transferring data over internet in a secure manner. It's achieved through adding SSL (Secure Socket Layer)/TLS (Transport Layer Security) on top of standards HTTP.

What HTTPS gives us?

1. End-2-end encryption of data - from the browser to the server and back = even if someone reads the data you are sending, they will not be able to understand anything out of it
2. Confirmation of the identity of the website we are accessing = you are sure that the website that looks like your bank is actually your bank (and not a phishing website)

How does it work?

First you need a pair of SSL certificates:

1. One installed in your web browser (in most cases shipped together with your browser, provided by one of so-called trusted Certificate Authorities)
2. One installed on the website (which is acquired by the website owner)

Each of those SSL certificates includes the following information: 

• Public information: name of the owner, website name (domain) for which it is valid, public key, digital signature, validity dates, issuer,
• Private information: private key

The initial handshake flow can be split into 3 phases - hello, certificate exchange and key exchanged:

1. Hello - to agree on the communication method

• Browser sends to the server information ClientHello message that includes among others information about version of the SSL/TLS that browser supports and cipher (encryption algorithm) that can be used to encrypt communication.
• Server responds with ServerHello message that among others already points at the SSL/TLS version and cipher that will be used to encrypt communication.

2. Certificate Exchange - to verify server identity

Sever sends public part of its SSL certificate to the client, which is able to verify the digital signature using the certificate installed in the browser (one coming from Certificate Authorities). If everything is ok, browser displays the green lock, information that the website is secure and (depending on the browser) the name of the owner next to the website URL, like below:

3. Key Exchange - to agree on the key used for encryption of the communication

Client generates a random encryption key for the cypher selected by the server, encrypts it with the public key provided by the server (which ensures that only server can decrypt it) and sends it to the server. Server encrypts the message and since this moment all the communication is encrypted with provided key and selected cypher.

Additional questions

• Can someone see the exact URLs I am sending to the server?

No, the only thing that the listening party will see is the IP of the server which is contacted. From the IP, a domain name can be reverse-engineering, but that's it. Your google queries are encrypted.

• How safe HTTPS is?

SSL/TLS is evolving, that's why it's important for service providers to update and patch their servers to the latest versions and for users to use latest versions of browsers. Over the years we saw information about SSL/TLS being broken, but in all cases these were old versions, with new versions of the TLS not having this problem.

Potentially more dangerous is the Certificate Authority trusted root certificates compromise. Fortunately those are not happening often (see some examples in this article) and companies behind your browser keep close attention to those incidents and remove those certificates from the 'trusted' list.