HTTP (Hypertext Transfer Protocol) and HTTPS (Secure Hypertext Transfer Protocol) are protocols used for transmitting data over the internet. The main difference between them lies in security and data encryption. Below is a detailed comparison and introduction to the relevant mechanisms:
1. Differences Between HTTP and HTTPS
-
Security:
-
HTTP: Data is transmitted in plaintext, making it easy to eavesdrop and tamper with.
-
HTTPS: Data is encrypted using SSL/TLS protocols, ensuring that it cannot be intercepted or altered during transmission.
Port:
-
HTTP: Uses port 80 by default.
-
HTTPS: Uses port 443 by default.
Certificate:
-
HTTP: Does not require a certificate.
-
HTTPS: Requires an SSL/TLS certificate to verify the server’s identity.
Performance:
-
HTTP: Performance is relatively faster due to the absence of encryption.
-
HTTPS: The encryption and decryption processes introduce some latency, but modern technology has significantly reduced this impact.
2. Use Case Differences
-
HTTP:
-
Suitable for scenarios where user privacy and data security are not a concern, such as public information websites, blogs, etc.
-
HTTPS:
-
Suitable for scenarios that require user data protection, such as online payments, user logins, personal information submissions, etc.
3. Certificate Mechanism
HTTPS uses SSL/TLS certificates to ensure security. The certificate is issued by a trusted Certificate Authority (CA) and contains the following information:
-
Public key of the certificate holder
-
Identity information of the certificate holder
-
Validity period of the certificate
-
Digital signature of the CA
4. Detailed Process of HTTPS Encryption
-
Client Requests Connection:
-
The client (e.g., browser) sends an HTTPS request to the server.
Server Response:
-
The server returns its SSL/TLS certificate, which includes the public key and other information.
Certificate Verification:
-
The client verifies the certificate’s validity (checks if it is issued by a trusted CA, whether it is expired, etc.).
Session Key Generation:
-
The client generates a random session key, encrypts it with the server’s public key, and sends it to the server.
Session Key Decryption:
-
The server decrypts the session key using its private key.
Encrypted Communication:
-
Afterward, the client and server use the session key for symmetric encryption communication, ensuring data security.
5. Contents Included in SSL/TLS Certificates
SSL/TLS certificates typically contain the following information:
-
Certificate Holder Information:
-
Includes organization name, domain name, address, etc.
Public Key:
-
The public key used for encrypting data.
Certificate Authority (CA) Information:
-
The name of the issuing authority and its digital signature.
Validity Period:
-
The start and end dates of the certificate.
Serial Number:
-
The unique identifier of the certificate.
Certificate Type:
-
For example, Domain Validation (DV), Organization Validation (OV), or Extended Validation (EV).
Fingerprint:
-
The hash value of the certificate, used for quick verification of its integrity.
6. Detailed Process of Certificate Verification
The certificate verification process typically includes the following steps:
-
Receiving the Certificate:
-
The client receives the SSL/TLS certificate sent by the server.
Checking Validity:
-
Verifies whether the certificate is within its validity period (checks start and end dates).
Verifying Signature:
-
Uses the CA’s public key to verify the digital signature of the certificate, ensuring it has not been tampered with.
Checking Revocation Status:
-
Queries the Certificate Revocation List (CRL) or uses the Online Certificate Status Protocol (OCSP) to check if the certificate has been revoked.
Domain Name Matching:
-
Ensures that the domain name in the certificate matches the domain name requested by the client.
Trust Chain Verification:
-
Verifies whether the certificate is issued by a trusted CA to ensure the trust chain is complete.
7. Detailed Process of Generating a Session Key
The process of generating a session key typically involves the following steps:
-
Client Generates Random Number:
-
The client generates a random number (Client Random) for subsequent key generation.
Server Generates Random Number:
-
The server generates a random number (Server Random), also for key generation.
Pre-Master Key Generation:
-
The client generates a Pre-Master Secret and encrypts it with the server’s public key.
Sending Pre-Master Key:
-
The client sends the encrypted Pre-Master Secret to the server.
Server Decrypts Pre-Master Key:
-
The server decrypts the Pre-Master Secret sent by the client using its private key.
Generating Session Key:
The specific generation process typically uses a Pseudo-Random Function (PRF) to combine the three random numbers above to generate a session key for symmetric encryption algorithms.
-
Client Random
-
Server Random
-
Pre-Master Secret
-
The client and server use the above information to generate the session key.
8. Conclusion
The main difference between HTTP and HTTPS lies in security; HTTPS provides encryption and authentication through the SSL/TLS protocol. HTTPS is suitable for scenarios that require user data protection, while HTTP is suitable for scenarios that do not require protection. The certificate mechanism and encryption process ensure the security of data during transmission.
SSL/TLS certificates contain holder information, public keys, CA information, validity periods, and other contents. The certificate verification process ensures the validity and integrity of the certificate. The session key generation process involves both the client and server generating random numbers and combining them with the Pre-Master Secret to generate a session key for symmetric encryption algorithms, ensuring the security of subsequent communications.
If you want to learn about testing development, please add Teacher Wu’s WeChat: fosterwu