HTTPS
HTTP over TLS — the encrypted, authenticated version of HTTP. HTTPS encrypts traffic and verifies the server's identity via a certificate. Every modern website should use HTTPS. The 'S' is TLS, which provides confidentiality, integrity, and server authentication.
- Every website, always.
- Any API handling sensitive data.
- Internal isolated networks where the threat model allows (rare).
Definition
HTTPS is HTTP wrapped in TLS. The client and server do a TLS handshake (exchange keys, verify the server certificate), then all HTTP traffic flows encrypted. TLS 1.3 does this in one round trip. Certificates are issued by Certificate Authorities (CAs) trusted by browsers.
Why it exists
Plain HTTP is readable and tamperable by anyone on the network. HTTPS prevents eavesdropping, tampering, and impersonation, and enables modern web features (HTTP/2, service workers, geolocation).
How it works
Client connects on port 443, server presents a certificate. TLS handshake negotiates encryption and verifies the cert via a CA chain. After the handshake, HTTP requests/responses are encrypted. Let's Encrypt provides free certificates.
Scaling limits
TLS handshake adds latency (mitigated by session resumption and TLS 1.3). Certificate management and renewal need automation (certbot, ACME).
Cost shape
Free certificates via Let's Encrypt. The cost is TLS handshake CPU and cert management.
Alternatives
- HTTP — Faster but insecure — never use for public sites.
Failure modes
- Expired certificates causing browser warnings.
- Mixed content (HTTP resources on HTTPS pages).
- Certificate chain issues.