HTTPS
What is HTTPS?
HTTPS serves the same data transfer function as HTTP, yet it adds an SSL(Secure Socket Layer) or TSL( Transport Layer Security) to keep the data transfer secure and encrypted. In other words, HTTPS eliminates man-in-the-middle attacks and protects legitimate domains from domain name spoofing (DNS) attacks.
When the browser requests the servers, the servers send their TSL/SSL certificate for the clients to verify. This certificate has the website’s public key(encryption) to establish a secure connection. After the browser verifies the certificate from a trusted certificate authority like GoDaddy, DigiCert etc, both the browsers and servers establish a secured connection where encrypting keys are exchanged.
The browser then encrypts the information by using the server’s encryption key, that is, the decryption key(private key) of the server. Then, the server decrypts the information received from the browser using the private key and sends back the responses to the browser. The browser would decrypt the response received and display the content to the user.