Https

Hypertext Transfer Protocol over Secure Socket Layer or HTTPS is a URI scheme used to indicate a secure HTTP connection. It is syntactically identical to the http:// scheme normally used for accessing resources using HTTP. Using an https: URL indicates that HTTP is to be used, but with a different default TCP port (443) and an additional encryption/authentication layer between the HTTP and TCP. This system was designed by Netscape Communications Corporation to provide authentication and encrypted communication and is widely used on the World Wide Web for security-sensitive communication such as payment transactions and corporate information systems.

How it works

Strictly speaking, https is not a separate protocol, but refers to the combination of a normal HTTP interaction over an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection. This ensures reasonable protection from eavesdroppers but is weak with man-in-the-middle attacks.

An https: URL may specify a TCP port; if it does not, the connection uses port 443 (unsecured HTTP typically uses port 80).

To prepare a web-server for accepting https connections the administrator must create a public key certificate for the web-server. These certificates can be created for Unix based servers with tools such as OpenSSL's ssl-ca [ [http://www.openssl.org/contrib/ OpenSSL: Contribution, Misc ] ] or SuSE's gensslcert. This certificate must be signed by a certificate authority of one form or another, which certifies that the certificate holder is indeed the entity it claims to be. Web browsers are generally distributed with the signing certificates of major certificate authorities, so that they can verify certificates signed by them.

Organizations may also run their own certificate authority, particularly if they are responsible for setting up browsers to access their own sites (for example, sites on a company intranet), as they can trivially add their own signing certificate to those shipped with the browser.

Some sites, especially those operated by hobbyists, use self-signed certificates on public sites.Using these provides protection against simple eavesdropping, but unlike a well-known certificate, preventing a man-in-the-middle attack with a self-signed certificate requires the site to make available some other secure method of verifying the certificate.

The system can also be used for client authentication, in order to restrict access to a Web server to only authorized users. For this, typically the site administrator creates certificates for each user which are loaded into their browser. These normally contain the name and e-mail address of the authorized user, and are automatically checked by the server on each reconnect to verify the user's identity, potentially without ever entering a password.

Limitations

The level of protection depends on the correctness of the implementation by the web browser and the server software and the actual cryptographic algorithms supported.

https only protects data in transit from eavesdropping and man-in-the-middle attacks. Once data arrives at its destination, it is only as safe as the computer it is on. Gene Spafford states that it is like "using an armored truck to transport rolls of pennies between someone on a park bench and someone doing business from a cardboard box." [ [http://homes.cerias.purdue.edu/~spaf/quotes.html Gene Spafford's Personal Pages: Quotable Spaf ] ]

Also, https is insecure when applied on publicly available static content. The entire site can be indexed using a web crawler and the URI of the encrypted resource can be inferred by knowing only the intercepted request/response size. [cite web|url=http://sysd.org/stas/node/220|title=The Pirate Bay un-SSL|last=Pusep|first=Stanislaw|date=07-31-2008|language=en|accessdate=2008-08-13] This allows an attacker to have access to the plaintext (the publicly available static content), and the encrypted text (the encrypted version of the static content).

Because SSL operates below http and has no knowledge of higher level protocols, SSL servers can only strictly present one certificate for a particular IP/port combinationFact|date=May 2008. This means that in most cases it is not feasible to use name-based virtual hosting with https. [http://tools.ietf.org/html/rfc3546 RFC-3546 TLS Extensions] describes a solution called Server Name Indication (SNI), although many older browsers don't support this extension. Support for SNI is available since Opera 8, Mozilla 1.8, Internet Explorer 7 on Windows Vista. [ [http://blog.ebrahim.org/archives/2006/02/21/server_name_indication_sni.php Server Name Indication (SNI)] ] [ [https://bugzilla.mozilla.org/show_bug.cgi?id=116169 Mozilla 1.8] ]

With the newer Internet Explorer 7, Microsoft has increased the warnings sent when certificates are not registered: whereas previously only a "security advice" pop up appeared, which differentiated between name, source and run time of the certificate, now a warning is displayed across the entire window, which suggests not to use the web site. Therefore, a certificate which is not registered in the browser is not useable for mass applications. Certificates which are registered in the root chains cost between USD $27 and USD $1,200 per year.

See also

*Computer security
*AAA protocol
*List of file transfer protocols
*Secure hypertext transfer protocol, an alternative to https that is not widely supported (defined in RFC 2660)

References

External links

* [http://wp.netscape.com/eng/ssl3/draft302.txt Netscape’s SSL 3.0 Specification]
* [http://www.apache-ssl.org/ Apache-SSL homepage] (No longer actively developed)
* [http://httpd.apache.org/docs/2.2/ssl/ Apache 2.2 mod_ssl documentation]
* RFC 2818 - HTTP Over TLS
* [http://msdn2.microsoft.com/en-us/library/aa767735(VS.85).aspx HTTPS Protocol in Internet Explorer Development - MSDN]
* [http://msdn2.microsoft.com/en-us/library/ms733768.aspx Manually Configuring Windows Communication Foundation (WCF) when using HTTP and HTTPS - MSDN]
* [http://msdn2.microsoft.com/en-us/library/bb250503.aspx HTTPS Security Improvements in Internet Explorer 7 & its Compatibility Impact - MSDN]