TechKnowSurge
CompTIA SecurityX 2.2 Cisco CyberOps Associate 2.10 Cisco CyberOps Associate 2.11 Cisco CCST Cybersecurity 1.4 CompTIA Network+ 1.4 CompTIA A+ Core 1 2.1 Cisco CCST Networking 1.5 Cisco CCST Cybersecurity 2.1
TechKnowSurge Catalog Videos HTTPS
VideoNetworkFree

HTTPS

HTTPS is the secure version of HTTP that runs on TCP port 443 and uses public key cryptography and digital certificates to encrypt web traffic and verify server identity. It protects users from interception and phishing attacks even on sites that don't handle sensitive data.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

HTTPS is the secure version of HTTP, operating over TCP port 443 instead of port 80. It uses digital certificates built on public and private key cryptography to encrypt traffic between a user's browser and a web server, ensuring that data in transit cannot be read by unauthorized parties. The original name, HTTP over SSL, reflects its roots, though TLS has since replaced SSL as the underlying protocol while the HTTPS designation remains standard. The need for HTTPS extends beyond obvious use cases like online banking and e-commerce. Any unencrypted web connection can be intercepted by an attacker who redirects the user to a spoofed site that looks identical to the intended destination. Even on sites with no inherently sensitive content, this kind of man-in-the-middle attack can be used to inject forms that collect credentials or personal data from users who have no reason to distrust what they see. The cryptographic mechanism at the core of HTTPS relies on paired public and private keys. Data encrypted with a public key can only be decrypted with the corresponding private key, and vice versa. This allows servers to prove their identity and enables secure, confidential communication. A self-signed certificate provides encryption but no verified identity, which is why browsers display a warning when one is encountered. Certificate authorities solve this problem by independently verifying that a certificate holder actually controls the associated domain, giving users a trusted basis for the connection they are making.

What you'll learn

What's covered

HTTPS

Aligned to

CompTIA SecurityX
2.2 Given a scenario, implement appropriate PKI infrastructure solutions.
Cisco CyberOps Associate
2.10 Describe the impact of certificates on security
2.11 Identify the certificate components in a given scenario
Cisco CCST Cybersecurity
1.4 Explain encryption methods and applications
2.1 Describe TCP/IP protocol vulnerabilities
CompTIA Network+
1.4 Explain common networking ports, protocols, services, and traffic types.
CompTIA A+ Core 1
2.1 Compare and contrast Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports, protocols, and their purposes.
Cisco CCST Networking
1.5 Describe common network applications and protocols

Key terms

Hypertext Transfer Protocol Secure
HTTPS
The encrypted version of HTTP that wraps web traffic in a TLS session, operating on TCP port 443, so that the data exchanged between a browser and a web server is confidential and cannot be read or modified by an eavesdropper. HTTPS is now the standard for all web traffic, indicated by the padlock icon in a browser.
Hypertext Transfer Protocol
HTTP
An application-layer protocol that defines how web browsers and servers communicate to request and deliver web pages and other content, operating over TCP on port 80. HTTP transmits data in plaintext, which is why it has been largely replaced by HTTPS for sensitive content.
Transport Layer Security
TLS
A cryptographic protocol that provides secure communication over a network, successor to SSL.
Secure Sockets Layer
SSL
A now-deprecated cryptographic protocol designed to provide secure communication over a network, replaced by TLS.
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity.
Certificate Authority
CA
A trusted entity that issues digital certificates used to verify the identity of individuals, organizations, or devices.
Public Key
A cryptographic key that can be shared openly and is used to encrypt data or verify digital signatures.
Private Key
A secret cryptographic key used in asymmetric encryption to decrypt data or create digital signatures.
Asymmetric Encryption
An encryption method that uses a public key to encrypt data and a private key to decrypt it.
Man-in-the-Middle Attack
MitM
An attack where an adversary secretly intercepts and potentially alters communications between two parties.

Transcript

HTTPS

HTTPS is the same thing except that it's secure. HTTPS stands for HTTP Secure, or HTTP over SSL. Originally it was HTTP over SSL, although we really don't use SSL anymore, so the name has kind of stuck around, or we've transitioned now to using more HTTP Secure. It uses TCP port 443, so the port is a little different, and it uses something called certificates to help encrypt the data as it's transferring back and forth.

Why the move away from HTTP

As we see, there's a lot of trend moving away from HTTP and more towards HTTPS. But why is that the case? There's a lot of information out there, and besides, if I have a public website, why do I necessarily need it secure?

Well, the obvious answer is for things like credit cards and bank accounts. If I'm trying to access my bank account and there's somebody in between here that sees that I'm trying to access my bank account and then sends me to their site instead and intercepts that, and now I'm interacting with them, then it seems logical that I don't want that information to go to them.

But what happens when it's a site where I don't have sensitive information? Why do I care if other people see that or not? Well, the same thing can happen. Even if I'm going to something like example.com, which is just an example site and there's nothing really sensitive about it, or maybe it's a wiki site and there's nothing sensitive in there, or you name it, whatever site that you're going to where the data is not sensitive and I don't really care, this can still be intercepted. Somebody can still present it as if it's the site you're trying to get to and still put in there forms to gather information. The user that's on this computer right here may be trusting the site and may not realize that they're being sent to another site. I'm sitting here navigating this other site, and it asks me for some sort of sensitive information, and I trust this site, so I put it in there, and now somebody else is getting that sensitive information. So even though it's not sensitive information, it doesn't stop a phisher from being able to gather information from unsuspecting users if you're not securing that web traffic.

Public and private certificates

So then how does it secure this? Well, it's actually pretty awesome technology, pretty amazing. You have both public and private certificates. A private certificate is something that I hold on to and I don't let anybody else see or have. A public certificate I can give to anybody out there. And what I can do is I can encrypt with one of these and then it can be decrypted with the other.

So for instance, if I want to verify who I am, I've got this private certificate that no one can see, and I can encrypt some sort of data and send it to you. And if you have the public certificate and you decrypt it, you know that it came from the other private key, you know that it was encoded by the person who has that private key.

Or let's say I want to send you an encoded message. If I have your public key and I use your public key to encrypt something and send it to you, then only you can decrypt it, and so you can get the message but no one else can.

So these public private keys can be used to send traffic so no one else can read it, and it also can be used to verify some sort of authenticity, that it's coming from the correct location.

Self-signed certificates and certificate authorities

Of course, if I just claim, well, this is my private certificate and you have my public certificate, that's called self-signed. If you are just claiming that, but there's no proof of it, it's a self-signed certificate. And so if I go to a web page that has a self-signed certificate, then what happens is there's a little error that comes up on your screen and says this site isn't secure. So even though the traffic is actually getting encrypted as it's going back and forth, the other person on the other side hasn't proven who they are.

To prove who they are, we have something called a certificate authority. You can set your web pages up so that way when traffic gets to your web server, this user can actually check with a certificate authority and verify that you are in fact who you say you are. So there's a level of security that's involved with that. And to get these certificates and work with the certificate authorities, there's a level of proof that you have to go through to say that you in fact own a certain domain. It's all based off of the domain name.

So that is how certificates work. That's just a real brief overview, but it's pretty cool stuff. And once again, HTTPS uses these different certificates as a level of encryption.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →