HTTP/HTTPS: The Essence of Secure Web Transmission

When visiting a website, you may have noticed the small lock icon in the browser’s address bar. What does this lock mean? Why do some websites have it and others don’t? Behind this lock lies the fundamental difference between HTTP and HTTPS.

The difference between HTTP and HTTPS is not just an extra “S”; it is the cornerstone of web security.

HTTP: The Cost of Plaintext Transmission

HTTP (Hypertext Transfer Protocol) is the foundation of the web and is an application layer protocol.

Data Flow

HTTP 请求: 浏览器 → [格式化数据] → TCP → IP → 网络 → 服务器
HTTP 响应: 服务器 → TCP → IP → 网络 → 浏览器 → 渲染页面

Problems with HTTP

graph LR
    A[用户] -->|HTTP 请求| B[中间人]
    B -->|转发请求| C[服务器]
    C -->|明文响应| B
    B -->|明文响应| A
    B -.->|篡改数据| A

Plaintext transmission: usernames, passwords, and credit card numbers are fully exposed
No identity verification: cannot confirm who the server is
Data easily tampered with: intermediaries can modify response content

HTTPS: Implementing Encrypted Transmission

HTTPS is essentially HTTP over TLS/SSL, adding a security layer between the transport layer and the application layer.

HTTPS Processing Flow

应用层: HTTP 请求
    ↓
TLS 层: 加密、身份验证
    ↓
传输层: TCP
    ↓
网络层: IP

Core TLS Functions

Function	Implementation	Purpose
Encryption	Symmetric encryption	Data confidentiality
Authentication	Digital certificates	Confirm server identity
Integrity	MAC signatures	Prevent data tampering

TLS Handshake: How Encryption Is Established

When the client and server communicate for the first time, they need to “shake hands” to establish an encrypted channel:

sequenceDiagram
    participant C as 客户端
    participant S as 服务器
    C->>S: Client Hello（支持的加密算法）
    S->>C: Server Hello（选定的算法）
    S->>C: 发送证书（包含公钥）
    C->>S: 验证证书，生成随机密钥
    C->>S: 用公钥加密密钥，发送给服务器
    S->>C: 握手完成，后续用对称加密

Simplified Handshake Process

// 1. 客户端发送支持的加密套件列表
const clientHello = {
  versions: ['TLS 1.3', 'TLS 1.2'],
  cipherSuites: ['AES-256-GCM', 'CHACHA20-POLY1305']
};

// 2. 服务器选择并返回证书
const serverCert = await fetch('/server-cert');

// 3. 客户端验证证书，生成会话密钥
const sessionKey = generateRandomKey();
const encryptedKey = encryptWithPublicKey(sessionKey, serverCert.publicKey);

// 4. 后续通信用对称加密
const encryptedData = encrypt(data, sessionKey);

Certificates: The Cornerstone of the Trust Chain

Certificate Verification Process

graph TD
    A[浏览器] -->|检查| B[证书有效期]
    A -->|检查| C[证书域名]
    A -->|检查| D[颁发机构]
    D -->|检查| E[受信任根证书]
    E -->|验证| F[证书签名]

Self-Signed Certificates vs Trusted Certificates

# 自签名证书（开发用）
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

# 正式证书（需要 CA 签发）
# 由 Let's Encrypt、 DigiCert 等机构颁发

HTTP/2 and HTTP/3

Modern HTTPS is not only about transport security. It also unlocks protocol upgrades:

Version	Features	HTTPS Requirement
HTTP/1.1	Persistent connections	Optional
HTTP/2	Multiplexing, header compression	HTTPS required
HTTP/3	QUIC, lower latency	HTTPS mandatory

The HTTP/2 protocol itself does not mandate HTTPS, but browsers only support HTTP/2 over TLS. HTTPS has now become the standard, Let’s Encrypt provides free certificates, and the lock icon represents the protection of user data.