{"id":16020,"date":"2023-01-09T17:26:11","date_gmt":"2023-01-09T22:26:11","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=16020"},"modified":"2023-03-10T12:44:18","modified_gmt":"2023-03-10T17:44:18","slug":"what-is-https-what-https-stands-for","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/what-is-https-what-https-stands-for\/","title":{"rendered":"What Is HTTPS? A 5-Minute Overview of What HTTPS Stands For"},"content":{"rendered":"\n

HTTPS is the difference between transmitting sensitive information securely to your bank and allowing cybercriminals to steal that data so they can use it to commit crimes. But there are some misconceptions about what HTTPS means that we want to clear up\u2026<\/h2>\n\n\n\n

Every day, you use websites to make purchases and pay bills online. But how do you know whether the website you\u2019re using is safe and secure? If you\u2019re like most users, you look for the little padlock icon in your web address bar and think you\u2019re using a safe website. But what if that\u2019s only part of the equation \u2014 what if that icon doesn\u2019t tell you the whole story?<\/p>\n\n\n\n

Cybercriminals love to exploit ignorance<\/a> about what that little padlock security icon and HTTPS really mean. It reminds me of a scene from Monty Python and the Holy Grail<\/em>, where some of King Arthur\u2019s Knights of the Round Table follow an icon in the sky to what they believe is the secret location of the Holy Grail. Turns out, it wasn\u2019t really the Grail, but the young women were using it to lure Grail-seekers to their castle.<\/p>\n\n\n\n

In much the same way, the security icon in your browser may be lulling you or other users into a false sense of security. Those security indicators aren\u2019t saying that the connection is safe<\/em>; they\u2019re conveying that a connection is secure<\/em>. Yes, there is a difference. And understanding HTTPS will help you better understand what that difference is and why it matters. That\u2019s why we\u2019re here to answer questions like \u201cwhat is HTTPS?\u201d and \u201cwhat does HTTPS stand for?\u201d<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

What Does HTTPS Stand For? A Simple Definition and Explanation of What HTTPS Is<\/h2>\n\n\n\n

HTTPS stands for \u201chypertext transfer protocol secure.\u201d Essentially, it\u2019s a set of rules that enable two entities (e.g., users and websites.) to exchange sensitive data online securely. This protocol enables your client (i.e., your browser) and the server it\u2019s connecting to, to forge a secure, encrypted connection using the secure transport layer security (TLS) protocol. This is why it\u2019s also sometimes called HTTP over TLS<\/em> or HTTPS secure<\/a>.<\/p>\n\n\n\n

HTTPS is the secure version of the traditional HTTP protocol. Without it, information would transmit in plaintext format, enabling cybercriminals to read, steal, and alter the data in transit. It\u2019s all about using authenticated digital identity<\/a> and encryption<\/a> to establish secure connections.<\/p>\n\n\n\n

Here\u2019s a quick visual overview of the difference between HTTP and HTTPS<\/a> website connections:<\/p>\n\n\n\n

\"A
Image caption: A set of comparison illustrations that showcase the difference between HTTPS and HTTP connections in terms of security.<\/em><\/figcaption><\/figure>\n\n\n\n

What Role Does Encryption Play in HTTPS?<\/h3>\n\n\n\n

HTTPS uses encryption to protect data (such as credit cards, passwords, etc.) from being read by unauthorized parties while it\u2019s travelling across the internet.<\/p>\n\n\n\n

Encryption is the cryptographic process of taking plaintext data and scrambling it into random characters to disguise the message using cryptographic algorithms and keys. As a website owner, you use TLS connections (formerly secure sockets layer, or SSL connections) to encrypt the communication channel between users\u2019 web clients and your server.<\/p>\n\n\n\n

When you use encryption, you\u2019re preventing bad guys from gaining access to your sensitive data by scrambling it. The only way they\u2019d be able to access the information you send is by having your decryption key. So long as you take the appropriate steps to carefully manage your keys<\/a> and keep them secure using a key management<\/a> solution, then you don\u2019t have anything to worry about.<\/p>\n\n\n<\/span>\n\n\n\n

But encryption is only useful if you know who\u2019s on the other side of the connection…<\/p>\n\n\n\n

Authentication Helps Ensure You\u2019re Connecting to the Right Entity<\/h3>\n\n\n\n

As a user, authentication is what helps ensure that you\u2019re connecting to a legitimate website and not an imposter\u2019s phishing site. Your browser will review the website\u2019s SSL\/TLS certificate information (i.e., website security certificate<\/a>), which has been validated by a trusted third party known as a certificate authority<\/a> (CA). If everything is as it should be, then your browser will continue with the process of establishing a secure connection with the server. If not, your client will terminate the connection and display an ugly \u201cYour connection is not private\u201d message (or another similar warning).<\/p>\n\n\n\n

Remember how, at the beginning of the article, I\u2019d mentioned that safe and secure aren\u2019t synonymous terms? This is because you can have a secure (encrypted) connection, but if you don\u2019t know who is sitting on the other end of the connection to receive your encrypted sensitive information, then it isn\u2019t safe.<\/p>\n\n\n\n

Why? Because you\u2019re handing over your sensitive data to an unknown entity. Even if your data is sent via an encrypted connection, there could be a bad guy sitting on the other end with the secret key. Once they decrypt your sensitive data, they could sell it or use it for other nefarious purposes.<\/p>\n\n\n\n

This is why encryption and authentication are both used in establishing HTTPS connections. All SSL\/TLS certificates authenticate the website\u2019s domain name, but only high-assurance certificates authenticate who (e.g., what organization) is running the website (more on that in a bit).<\/p>\n\n\n\n

How HTTPS Works When You Connect to a Website<\/h2>\n\n\n\n

We\u2019ve already written at length about how HTTPS works<\/a>, so we\u2019re not going to re-hash all of that here. However, here\u2019s a quick and basic overview of how it works:<\/p>\n\n\n\n