What is HTTP, HTTPS, and SSL
Tags: http, https, ssl
Published: 2021-11-08 13:19:34

# Introduction

If you are a developer, you probably know what an `SSL` certificate is. If you don't know what it is, don't worry. An `SSL` certificate is a must-have on any website. It lets your web browser connect to a web server securely. `SSL` stands for **Secure Sockets Layer**, and it is a digital certificate that allows for an encrypted connection.

But let's back it up a bit. First, we need to know what lets a web browser and a webserver connect. To connect with a website, we need `HTTP`.

# What is `HTTP`?

`HTTP` stands for **Hypertext Transfer Protocol** and this protocol is used to transfer data from the web servers to web browsers. So if you ever visit a website you can notice the protocol being added at the beginning of the web address. So for example `http://www.website.com`. This protocol is used to view different web pages on the internet.

By default in standard `HTTP`, all of the information is sent in clear text. What this means is when you type something, it gets sent over the public internet which means that hackers can view it, because it's all sent over in clear text.

This isn't a problem, that is if you only browse a website, but if there are any passwords involved, or any other personal information, such as credit card information, then a hacker could easily get that info. Due to the fact it's being sent over the public internet, a hacker could listen in as the data is being transferred and could steal it.

If you ever have to type in personal information, you should always check if you have a secure connection. And for you to have a secure connection, you would need to use `HTTPS`.

# What is `HTTPS`?

`HTTPS` is `HTTP`, but secure. That's why there is an `S` added. **Hypertext Transfer Protocol Secure**. What this does is encrypt the data that is being retrieved by `HTTP`. It lets all of the data that is being transferred between the server and the computer secure. The way it does that is by making the data impossible to read by encryption algorithms that mix up the data that's being transferred.

So whenever you are on a site and you have to enter a password or some credit card information, make sure the web address looks like this - `https://www.website.com`. This means that the data that you pass in will be protected. You can also notice a padlock to the left of the web address, which also indicates you are using a secure `HTTP`.

Thanks to the encryption algorithms the data we put in comes out all scrambled up so that hackers can't understand and decrypt it.

`HTTPS` secures the data thanks to a protocol called:

# `SSL`

`SSL` stands for **Secure Sockets Layer** and it is a protocol that's used to establish security on the internet. But how exactly does `SSL` work? Well, it uses public-key encryption to secure data.

What this means is when a computer connects with a website that is using `SSL`, the computer's web browser will ask the website to say who it is or identify itself. Then the webserver will send the computer a copy of the `SSL` certificate it has.

An `SSL certificate` is a small digital certificate that is used to validate the identity of a website. Or in other words, this lets your computer know that the website you're visiting is reliable and trustworthy.

So then the browser of the computer can check if it trusts the certificate and if it does it will send a message to the web server, to which then the web server will respond with a response so that an `SSL` session can begin.

Most `SSL` certificates have to be paid for, but there are also some free ones, for example:

# Let's Encrypt

`Let’s Encrypt` is a Certificate Authority (CA) that provides an easy way to obtain and install free `SSL` certificates, thereby enabling encrypted HTTPS on web servers. You could check this post out on [How To Secure Nginx with Let's Encrypt on Ubuntu](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04) so that you can get a little bit more familiar with `Let's Encrypt`. 

# Conclusion

This may seem confusing at first, but it's best to get to know how the internet actually works and the different protocols that are out there. If you notice almost all of the sites nowadays have `HTTPS` instead of `HTTP`, even though there isn't any data to be transferred between servers, and that's because Google has started flagging websites as **Not Secure** because they aren't protected with `SSL`.

I hope that this post has helped you learn a little bit more about these protocols that you use daily and how they work.