Information AboutPort 443 |
| CATEGORIES ABOUT HTTPS | |
| http | |
| cryptographic protocols | |
| uri scheme | |
|
https is a indicates that HTTP is to be used, but with a different default TCP Port (443) and an additional Encryption / Authentication layer between the HTTP and TCP . This system was designed by Netscape Communications Corporation to provide Authentication and Encrypted communication and is widely used on the World Wide Web for security-sensitive communication such as payment transactions and corporate logons. HOW IT WORKS Strictly speaking, https is not a separate protocol, but refers to the combination of a normal HTTP interaction over an Encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection. This ensures reasonable protection from eavesdroppers and Man-in-the-middle Attack s. An https: URL may specify a TCP Port ; if it does not, the connection uses port 443 (for unsecured HTTP, it uses 80). To prepare a web-server for accepting https connections the administrator must create a 's gensslcert. This certificate must be signed by a Certificate Authority of one form or another, who certifies that the certificate holder is who they say they are. Web browsers are generally distributed with the Signing Certificates Of Major Certificate Authorities , so that they can verify certificates signed by them. Organizations may also run their own certificate authority, particularly if they are responsible for setting up browsers to access their own sites (for example, sites on a company intranet), as they can trivially add their own signing certificate to those shipped with the browser. Some sites, especially those operated by hobbyists, use self-signed certificates on public sites. Using these provides protection against simple eavesdropping, but unlike a well-known certificate, preventing a Man-in-the-middle Attack with a self-signed certificate requires the site to make available some other secure method of verifying the certificate. For example, a site may publish a telephone number over which visitors may verify the checksum. The system can also be used for client Authentication , in order to restrict access to a Web server to only authorized users. For this, typically the site administrator creates certificates for each user which are loaded into their browser. These normally contain the name and e-mail address of the authorized user, and are automatically checked by the server on each reconnect to verify the user's identity, potentially without ever entering a password. LIMITATIONS The level of protection depends on the correctness of the Implementation by the Web Browser and the server software and the actual Cryptographic Algorithm s supported. A common misconception among credit card users on the Web is that ''https:'' fully protects their card number from thieves. In reality, an encrypted connection to the Web server only protects the credit card number in transit between the user's computer and the server itself. It doesn't guarantee that the server itself is secure, or even that it hasn't already been compromised by an attacker. Because SSL operates below http and has no knowledge of higher level protocols, SSL servers can only present one certificate for a particular IP/port combination. This means that in most cases it is not feasible to use Name-based Virtual Hosting with HTTPS. REFERENCES SEE ALSO
EXTERNAL LINKS
|
|
|