HTTPS

HTTPS takes the HTTP protocol, and simply layers a SSL/TLS referred to simply as “SSL”. It also has an encryption layer on top of it. Servers and clients still speak the same HTTP to each other, but over a secure SSL connection that scrambles and decrypts their demands and replies. The SSL layer has 2 main purposes are verifying that you are speaking straight to the server that you think you are speaking to. Ensuring is so the server can read what you send it and only you can read what it sends back. This all start with a so called “handshake” which establish an SSL connection between a client and server. Once the connection is recognized, both parties can use the approved algorithm and keys to securely conduct messages to each other. The handshake has 3 main phases. They are called Hello, Certificate Exchange and Key Exchange. Hellos consist of all the data the server needs in order to join to the client via SSL, containing the numerous code groups and maximum SSL version that it supports. The server replies with a Server Hello which encloses alike data necessary by the client, with a decision created on the client’s likings about which encryption suite and version of SSL will be used. Now that communication has been recognized, the server has to prove itself to the client. This is completed using its SSL certificate, which is like password to prove you are who you say you are. SSL certificate holds several pieces of data, including the name of the owner. The domain is attached to, the certificate’s public key, the digital signature and info about the certificate’s legitimacy dates. The client checks that it either indirectly trusts the certificate, or that it is confirmed and reliable by one of numerous Certificate Authorities that it also discreetly trusts. The Key Exchange is the encryption of the real communication data exchanged by the client and server will be done using a symmetric algorithm. The strict nature of which was previously decided during the Hello phase. A symmetric algorithm uses a single key for both encryption and decryption, in contrast to asymmetric algorithms that require a public or private key pair.
References:
http://robertheaton.com/2014/03/27/how-does-https-actually-work/