Skip to main content

How HTTPS works, Complete flow in an understandable way



There are so many tutorials and explanations on the Internet to show how HTTPS works, but most of them tell half of the story. You may end up with so many questions, like where the certificates fit in? Where is the TCP stuff? How does the encryption works? How the trust works?

So, I made this diagram to fit the pieces of the puzzle together and show you how they all fit in an HTTPS request. Some of the low-level parts I didn't include and also each step in this would be briefed not to confuse anybody and make it short as possible to understand.

Here, the client could be a typical web browser (or even another application whoever can communicate with a website or an API).

Something you have to know before you check the diagram is public, private, and shared keys.
To know this, we have to learn about encryption because we use these keys to encrypt data.

There are two encryption types.

1. Asymmetric encryption aka. public-key encryption
2. Symmetric encryption aka. shared key encryption (sometimes also called private-key encryption too)

Asymmetric encryption 


Asymmetric encryption uses two keys, one is public, the other one is private. The public key, you can share it with anybody, but you will never share the private key. The cool thing about this would be, once you encrypt with either of the keys, you can never decrypt it with the same key. To decrypt it, you have to have the other key.

So somebody encrypts something with his private key and shared it, somebody else can decrypt it with the public key. This allows, somebody, to make sure the authenticity of the encrypted data because in order to decrypt it properly with the public key, it could have been only encrypted by the original sender's private key. So there's no chance somebody tampered the data in the middle.

Symmetric encryption


This is fairly simple as it uses only a single key. Once a key is generated, it has to be shared with two parties. So the same key is used to encryption and decryption.


How HTTPS works

Please note that here we are only talking about a typical scenario where it validates only the server's certificates (One-way SSL). There is another scenario where the server also requires to validate the client's certificate (Two-way SSL), where it will have an extra step to validate the client's certificate from the server-side.

How HTTPS works: Complete flow in an understandable way

How HTTPS works: Complete flow in an understandable way




I tried to simplify this as much as possible and again wanted to have enough information, hope it helps.

You will be able to clearly identify each step if you could use Wireshark and trace an HTTPS request.

By the way, if there are any misinterpretations or anything, please leave a comment.




Comments

Popular posts from this blog

Java, how to create a list with a single element

 I wanted to create a Java List with a single element. Yet, I wanted to add more elements later. So, I was looking for a couple of ways to do this. So far there are multiple elegant ways to create a list with a single element with a one-liner. Not so much for a modifiable list though. Here's what I gathered so far. Followings are a few ways of creating a list with strictly a single entry. Can't add more elements. 1. Collections.singletonList() This returns an immutable list that cannot be modified or add more elements. // An immutable list containing only the specified object. List<String> oneEntryList = Collections. singletonList ( "one" ) ; oneEntryList.add( "two" ) ; // throws UnsupportedOperationException 2.  Arrays.asList() This returns a fixed-size list consisting of the number of elements provided as arguments. The number of elements provided would be an array hence the size is fixed to the length of the array. // Returns a fixed-size list List...

How to fix SSLHandshakeException PKIX path building failed in Java

TL ; DR 1. Extract the public certificate of the website/API that you are trying to connect from your Java application. Steps are mentioned in this post 2. Use the Java keytool to install the extracted certificate into the "cacerts" file (Trust store) keytool -import -trustcacerts -alias <domain name> -file <public certificate>.cert -keystore /path_to_java_home/jre/lib/security/cacerts -storepass changeit 3. Restart your Java application Exception A typical exception stack trace would look like below. javax.net.ssl. SSLHandshakeException : sun.security.validator.ValidatorException: PKIX path building failed : sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) at sun.security.ssl.Handshake...

Ubuntu DNS issue fix DNS_PROBE_FINISHED_BAD_CONFIG

Issue  I've been playing with a VPN and somehow it messed up my DNS resolution configurations. Chrome gives  DNS_PROBE_FINISHED_BAD_CONFIG  error and can't ping google. So it seemed to be an issue with the DNS. Of course, restarting didn't fix it. I tried DNS lookup which gave me below. To make sure this is somehting to do with my DNS confgis, I ran the same by providing the google DNS servers.  It works, which means my default DNS is not working for some reason. To make sure this, ran the below command. systemd-resolve --status Output has an entry for DNS Servers, which was  ::1 Fix 1. Edit the file /etc/systemd/resolved.conf. sudo vi /etc/systemd/resolved.conf 2. Add new DNS entries. I added 2 google DNS and the cloudflare DNS sever. [Resolve] DNS=8.8.8.8 8.8.4.4 1.1.1.1 3. Restart the systemd-resolved and check the configuration is persisted in /run/systemd/resolve/resolv.conf file. sudo service systemd-resolved restart cat /run/systemd/resolve/resolv.co...