What Is HTTPS? Ensuring Secure Online Communication

Google, Wikipedia, and ChatGPT are my digital best friends. My thirst for knowledge is insatiable and I use these tools several times a day (in an attempt) to quench it. In other words, I’m like Curious George (I was called that like 500 times when I was a child) I’m not the only one with limitless curiosity; Google processes more than 255,000 searches per second!

You must be careful when you’re browsing the internet, as miscreants know we’re on the constant hunt for answers. They may create HTTP (insecure) websites to lure you into their trap and steal sensitive information from you, like credit card details. Don’t be alarmed — popular search engines like Google and Bing prioritize HTTPS (secure) websites.

HTTPS stands for Hypertext Transfer Protocol Secure, and it encrypts your data as it’s sent from your browser to the website’s server and back to your browser.

Whether you’re a casual internet user or a prospective website owner, my guide covers everything you need to know about HTTP and HTTPS.

You can think of a website as a home for information. For example, if you’re a Manchester United fan like me, you can access all information about the club by accessing its home address: https://www.manutd.com.

If you click on this link, you’ll see several images, videos, blogs, and product listings. All this information is stored on a remote web server and is transferred to your web browser (such as Google Chrome) when you request access.

You may notice the URL starts with “https://”. Hypertext Transfer Protocol Secure (HTTPS) is a protocol responsible for securely transferring this data from the web server to your screen.

While HTTPS is the primary protocol for internet communication, it’s not the only one. The internet has layers of protocols that work together to handle tasks, such as loading Manchester United’s official website on your screen.

Some other protocols that form the backbone of the internet include:

• Simple Mail Transfer Protocol (SMTP)
• Post Office Protocol version 3 (POP3)
• Domain Name System (DNS)
• Dynamic Host Configuration Protocol (DHCP)
• Address Resolution Protocol (ARP)
• Internet Control Message Protocol (ICMP)

HostingAdvice.com is HTTPS-protected as well. In fact, any website worth its salt should use the HTTPS protocol. Mind you, HTTP isn’t a separate protocol — it’s a less secure version.

HTTP vs. HTTPS

I’m not finished with the HTTP vs. HTTPS discussion yet. HTTP and HTTPS are two peas in a pod. HTTP was the need of the hour when it was introduced in 1989. It had glaring limitations, though. X (formerly Twitter) accounts have a blue tick, right? HTTP websites are like unverified X accounts — just about anyone can create one.

Additionally, all communications are in the plain-text format. This basically means anyone can intercept the communications and misuse data. For example, if you access an HTTP website and enter your credit card details to purchase an item, someone could intercept the request, steal your details, and impersonate you.

HTTPS was introduced in 1994 to build on the shortcomings of HTTP; It authenticates the identity of the website through an SSL certificate (more soon) and encrypts communications. It’s better to be safe than sorry — always go with HTTPS, my friend.

You already know HTTPS provides website authentication, encrypts data sent over the internet, and protects confidential data from unauthorized access. The real question is, how does it perform these functions?

It’s not a solo operator; Certificate authorities and SSL/TLS have significant roles in website identity verification and encryption mechanisms.

The Encryption Mechanism

HTTPS uses the SSL/TLS cryptographic protocols to encrypt data before sending it over the network.

Just like businessmen shake hands when they greet each other and after sealing a business deal (I know you’ve watched The Godfather trilogy), the encryption process begins with a “handshake” between the client (you) and the server (where website information is stored) — it authenticates their identities and establishes a secure session between them.

TLS/SSL uses both asymmetric and symmetric encryption to protect data in transit (on the move). I’ll explain how both techniques work soon, with a greater focus on asymmetric encryption.

Certificate Authorities (CAs)

An SSL certificate is a digital certificate that’s issued by certificate authorities (CAs). If you plan on launching a new website, you’ll have to get an SSL certificate to verify its authenticity (in the public eye) and secure it with an “https://” URL (as opposed to an “http://” URL).

CAs verify website identities by validating whether you indeed have control over the website (they may send an email to the email address linked to the website, for example) and thoroughly verifying your identity.

There are several types of SSL certificates and the ones with higher security measures (like the ones eCommerce and social media giants use) are more heavily scrutinized by CAs than lower-level ones (like the ones normal blogs and personal websites use).

Once a CA has issued an SSL certificate to your website, any user accessing it will see the above secure connection icon (a padlock) on their screen, as you can see from the picture.

Public and Private Keys

Asymmetric encryption, AKA public-key encryption, uses a public key, a session key, and a private key for secure internet communication. Let me simplify this for you. I talked about the handshake process a couple subsections ago. During this process, the server sends its public key to your web browser. Your browser uses it to randomly generate a session key (and establish a session).

This key can only be decrypted by the server using its private key. This protects all communications between the server and browser against eavesdropping.

Once the session key has been exchanged, further communication between the web browser and server is encrypted using symmetric encryption algorithms such as AES. I’m not going to dive further into symmetric encryption, as it’s unnecessary. All you need to know is it’s faster than asymmetric encryption and a good choice to encrypt large amounts of data.

Choosing the right SSL/TLS certificate for your website is the first step to implementing HTTPS. Once you’ve purchased and installed a certificate, you must configure your server for HTTPS and update all internal links and resources.

Many web hosts include automatic HTTPS configuration with their plans, so you can wipe the beads of sweat from your brow! And if they don’t, I’ve got you covered.

Choosing the Right SSL/TLS Certificate

A Domain Validation (DV) certificate is the lowest-level SSL certificate and is a favorite among web hosts; Your hosting plan will likely include one. If you’re ready to splurge cash, a higher-tier hosting plan may include a premium Organization Validation (OV) or Extended Validation (EV) certificate.

A DV certificate should be enough if you plan to launch a website with minimal eCommerce or sensitive data transactions. OV and EV certificates offer higher levels of validation and trust and you should only opt for one if you intend to launch a heavy-hitting website.

Here’s a more detailed overview of the types of SSL certificates — please take note of the website categories I have mentioned under each type.

Types of Certificates:

• Domain Validation (DV): A DV certificate is the most basic SSL certificate. It’s the cheapest and includes minimal domain verification (by the CA) and basic encryption. A DV certificate is perfect for a personal website or blog, small business website, nonprofit organization (NGO), community forum, or informational website that does not handle sensitive information.

• Organization Validation (OV): An OV certificate is more expensive than a DV certificate and takes domain ownership verification more seriously. The CA verifies details such as the legal existence of your organization, its physical address, and telephone number, which is why it takes longer to issue one. You can’t go wrong with an OV certificate if you’re a medium-sized business owner.

• Extended Validation (EV): An EV certificate is an umbrella of trust for your website. If you opt for EV certification, the affiliated CA will rigorously verify your identity to establish absolute legitimacy. The approval process for an EV certificate is the longest but bears the most fruit — it’s associated with the highest level of trustworthiness. It’s ideal for eCommerce websites and financial institutions.

To conclude, when choosing an SSL certificate, consider factors such as the nature of your business, budget, and desired level of user trust.

Remember, you don’t have to purchase an SSL certificate if your hosting plan includes one, and services such as Let’s Encrypt offer free ones.

Steps to Implement HTTPS

Suppose your favored hosting plan includes an SSL certificate. In that case, you may not have to manually install, configure, or maintain it — the web host will typically take care of that for you, though you can still review and manage your certificate through the control panel.

Let’s assume you’ve already bought a plan and want to purchase an SSL certificate separately. I recommend implementing it for your website through cPanel (it’s the most popular web hosting control panel). Read on to learn how.

Purchasing and Installing a Certificate

I’m going to keep it short and sweet. You must visit your preferred CA’s website (Let’s Encrypt, DigiCert, and Sectigo are solid choices) to select an SSL certificate (DV, OV, or EV). Then, you must generate a certificate signing request (CSR) by logging in to cPanel (the SSL/TLS section in cPanel).

A CSR is an application sent from an SSL certificate applicant to a certificate authority, similar to a form to open a new bank account.

1. Click on the Certificate Signing Requests (CSR) section of the CA’s site to generate a new SSL certificate signing request.
2. Provide all required verification details and click on the “Generate” button (or whatever equivalent). You must use the CSR generated from cPanel to complete the SSL certificate purchase on the CA’s website (download the certificate and upload it on the CA’s website).
3. Once you’ve obtained the certificate from the CA, log back into cPanel and upload the certificate (.crt file), private key file, and CA bundle to your server through the Certificates (CRT) section.

At this stage, the web host will either automatically install the certificate or guide you through the process.

Configuring Your Server for HTTPS

The last thing you need is for your website to use HTTP despite having an SSL certificate — simply buying an SSL certificate isn’t enough. You need to configure your server for HTTPS.

1. The first step is to log in to your cPanel account and click on the DOMAINS section followed by the Domains icon.
2. Next, locate your domain name and click on the Manage button beside it.
3. Scroll to the Website Data option and click on the Website field. You can now change the protocol from HTTP to HTTPS.

Don’t forget to save the changes!

Updating Internal Links and Resources

I recommend using a tool such as SSL Checker to check whether your website’s SSL certificate is correctly installed. Then, you can update internal links and resources to point to HTTPS in bulk (instead of HTTP) through your website’s content management system (I prefer WordPress) instead of doing it manually for each one. This is an important step, as you don’t want them to load over the insecure HTTP protocol (mixed content).

Common Pitfalls and Troubleshooting

Mixed content issues and certificate expiry are two of the most common problems with SSL certificates. To prevent mixed content issues, just follow my advice from the previous subsection. Failure to do so may cause web browsers to block incompatible web pages from your website when your users try to access them.

Everything has an expiry date. So do SSL certificates. If you don’t set up your certificate for automatic renewal, your visitors will experience security warnings or trouble establishing a secure connection after the certificate’s expiration. Mark your calendar and update your SSL certificate 15 to 30 days before expiry to avoid this.

An HTTPS website is better than an HTTP website on any day of the week. Chances are you’re on the hunt for a web hosting plan. Most reputable web hosts offer a free SSL certificate when you purchase a hosting plan (guaranteeing HTTPS status).

If your preferred web hosting provider doesn’t, don’t worry. You can get a free SSL certificate from a CA such as Let’s Encrypt or a paid, high-level certificate. Once your website is HTTPS-enabled, the following benefits will be available.

While you can still use HTTP on your website, keep in mind most major web browsers will display a warning when a user tries to access it; You’d be a fool to do so, as HTTPS is the global communications protocol standard. HTTP is a mere afterthought now.

Historical Background

Despite its limitations and the launch of the improved HTTPS protocol in 1994, early internet users and businesses, in particular, were silly enough to use HTTP until the early 2000s. After numerous phishing attempts, fishy eCommerce sites, and other types of online fraud, sense finally prevailed. I mean, didn’t businesses hire digital security experts back in the day?

I know I’m being harsh, but you should always be one step ahead of criminals — they should have anticipated the rise of cybercrime. Today, HTTPS is the default protocol for secure internet communications (all’s well that ends well — I’m a big Shakespeare fan). It addresses the shortcomings of HTTP, especially when transmitting confidential data such as financial or personal identification details.

Anyway, it’s time to look at some of the most exciting developments in HTTPS, of which the development of post-quantum cryptography (PCQ) algorithms, in particular, caught my eye!

Industry Trends

Just as an experiment, try accessing any website with a URL that starts with “http://”. Your browser will likely prohibit access to it or, at the least, display a warning.

The HTTPS Everywhere Initiative is gathering momentum. Major organizations and web browsers are joining hands to promote HTTPS’s benefits and implement stricter policies to thwart HTTP connections.

Additionally, the launch of initiatives such as Let’s Encrypt has made it easier to obtain an SSL certificate. I hope this article will make a difference!

Advancements in Security Protocols

The latest version of TLS, TLS 1.3, is meaner and stronger. It promises to ward off jailbirds (I bet you never heard this word before!) through more vigorous cryptographic algorithms and increase the efficiency of the handshake process.

There’s also a focus on developing lightweight TLS implementations suitable for applications, including the Internet of Things (IoT) and edge computing.

Quantum Computing and Encryption

While there’s a lot of buzz around quantum computing, too much power in the wrong hands could cause a catastrophe. Simply put, an attacker could use quantum computing to “break” current TLS/SSL encryption methods.

Talking of vigorous cryptographic algorithms, it’s hard to look past PQC algorithms. They could be used to stop quantum computing attacks and will likely be integrated into the TLS/SSL protocols soon.

While a small fraction of website owners still use HTTP, more than 90% of desktop and mobile websites support HTTPS. I bet you’re laughing too. Here’s a rationalization.

This minority must have next to no users (small or personal websites) or are inactive, as popular web browsers such as Google Chrome display warnings for HTTP websites, discouraging users from accessing them.

HTTPS is not a want — it’s a need. All active websites should use it and I know you will use it in your website as well. I’m a good guru, after all.