Introduction
HTTP and HTTPS are web communication protocols. HTTP transfers data without transport encryption, while HTTPS uses HTTP over TLS to protect the connection. The term SSL Certificate is common, but modern HTTPS deployments use TLS.
01 — What Is HTTP?
HTTP transfers requests and responses without TLS encryption. It conventionally uses port 80/TCP, so information sent through a plain HTTP connection can be read or modified by an attacker on the network path.
02 — What Is HTTPS?
HTTPS is HTTP carried over TLS. It conventionally uses port 443/TCP and protects the connection with encryption, integrity checks, and server authentication.
03 — What Is a TLS Certificate?
A TLS Certificate binds the server public key to its domain identity so the browser can authenticate the server. The certificate itself does not encrypt the page content; it supports the authenticated TLS handshake that establishes the session keys used for encryption and integrity protection.
Domain identity
The certificate helps the browser verify that the server is authorized for the requested domain name.
Encryption
TLS uses negotiated session keys to encrypt data in transit after the handshake.
Integrity
TLS detects unauthorized changes to protected data while it is being transmitted.
04 — TLS Handshake
During a simplified TLS handshake, the client sends ClientHello with supported protocol versions and cryptographic options. The server responds with ServerHello, presents its certificate, and the peers perform key exchange. After the server identity is validated and the handshake completes, both sides use shared session keys to protect HTTP requests and responses.
05 — Check a Certificate
Use these commands to inspect the TLS connection and make an HTTPS header request. Replace the example domain with the target host you are authorized to test.
openssl s_client -connect example.com:443 -servername example.comcurl -I https://example.com06 — Redirect HTTP to HTTPS
Keep an HTTP listener only to redirect visitors to the HTTPS URL. The following Nginx server block returns a permanent redirect.
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}07 — HSTS
The Strict-Transport-Security response header tells browsers to use HTTPS for future connections to a host. It strengthens protection against downgrade attempts after the browser has received the policy over HTTPS.
Test before enabling broadly
HSTS must be sent over HTTPS. Enabling includeSubDomains or a long max-age before every affected host supports valid HTTPS can make those hosts unavailable to users, and browsers do not allow users to bypass certificate errors for HSTS hosts.
08 — Common Errors
Certificate Expired
Renew and deploy the certificate before its expiry date, then verify that the server is presenting the renewed certificate.
Hostname Mismatch
Ensure that the requested host name appears in the certificate Subject Alternative Name entries.
Untrusted CA or Incomplete Chain
Install a certificate issued by a trusted CA where public trust is required and configure the complete intermediate certificate chain on the server.
Mixed Content
Load every script, stylesheet, image, font, and other subresource over HTTPS when the main page is delivered over HTTPS.
HTTP and HTTPS Comparison
| Feature | HTTP | HTTPS |
|---|---|---|
| Transport protection | No TLS encryption | HTTP over TLS |
| Typical port | 80/TCP | 443/TCP |
| Confidentiality and integrity | Not provided by HTTP itself | Provided by TLS |
| Server identity | No TLS certificate validation | Validated with a TLS certificate |
| Recommended for websites | No | Yes |
Best Practices
- Serve all pages and subresources over HTTPS and redirect HTTP to HTTPS.
- Use currently supported TLS versions and maintain a valid, complete certificate chain.
- Monitor certificate expiry and renew certificates before they expire.
- Test HTTPS and all subdomains before enabling broad HSTS policies.
Troubleshooting
When HTTPS does not work as expected, verify the domain name, certificate validity period, certificate chain, server TLS configuration, and the web-server redirect. Review browser developer tools for mixed-content warnings.
Frequently Asked Questions
Is SSL the same as TLS?
SSL is the older name that remains common in product names such as SSL Certificate. Modern secure web connections use TLS.
Does an HTTP redirect replace HSTS?
No. A redirect helps users reach HTTPS, while HSTS instructs browsers to use HTTPS directly for future requests after receiving the policy securely.
Why can a valid certificate still show an error?
The requested host name may not match the certificate, the intermediate chain may be incomplete, or the client may not trust the issuing CA.
Conclusion
HTTPS protects HTTP with TLS by providing encryption, integrity, and server authentication. Use a valid TLS certificate, redirect HTTP to HTTPS, test all resources for secure loading, and enable HSTS only after confirming that the relevant hosts can reliably serve HTTPS.
