2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.4 HTTPS and TLS Basics – Port 443
HTTPS mhanje HTTP + TLS. TLS teen goshti deto: confidentiality (गोपनीयता – dusra vachu shakat nahi), integrity (अखंडता – madhe koni badal karu shakat nahi) aani server authentication (certificate mule "ha kharach example.com aahe").
Browser Server
| ClientHello (TLS versions, cipher suites, random) -->|
|<-- ServerHello + Certificate (public key, signed by CA)|
| Browser verifies certificate: name, expiry, CA chain |
| Key exchange (ECDHE) -> both derive the same |
| session key; no key is ever sent in clear |
|<========= encrypted HTTP (symmetric, e.g. AES-GCM) ===>|
| Term | Meaning |
|---|---|
| Certificate | Server's public key + domain name, signed by a Certificate Authority (CA) |
| CA | Trusted organisation that signs certificates (for example Let's Encrypt) |
| Symmetric encryption | Same key encrypts and decrypts – fast, used for the actual data |
| Asymmetric encryption | Public/private key pair – used for identity and key exchange |
| TLS 1.2 / 1.3 | Current secure versions; SSL 2/3 and TLS 1.0/1.1 are obsolete |
curl -vI https://example.com 2>&1 | grep -E "SSL|TLS|subject|expire"
openssl s_client -connect example.com:443 -servername example.com </dev/null | head -20
Why this matters for security
HTTPS protects data in transit, not the application itself – a site with a valid padlock can still have SQL injection. Expired or self-signed certificates train users to click through warnings, which is exactly what phishing and MITM attackers want. In Part 6 we add free certificates with Certbot.
Ravindra Bagale's Tip
Many students say "there's a padlock, so the website is safe". No, friends! The padlock only tells you the connection is encrypted. Phishing sites use HTTPS too. Read the domain name carefully – paypa1.com and paypal.com are different.
Ravindra Bagale's Tip – मराठी
बरेच students म्हणतात "padlock आहे म्हणजे website safe आहे". नाही मित्रांनो! Padlock फक्त connection encrypted आहे हे सांगतो. Phishing sites पण HTTPS वापरतात. Domain नाव नीट वाचा – paypa1.com आणि paypal.com मध्ये फरक आहे.
Ravindra Bagale's Tip – हिंदी
बहुत से students कहते हैं "padlock है तो website safe है". नहीं दोस्तों! Padlock सिर्फ़ यह बताता है कि connection encrypted है. Phishing sites भी HTTPS इस्तेमाल करती हैं. Domain name ध्यान से पढ़ो – paypa1.com और paypal.com में फ़र्क है.
Practice task
Run the openssl s_client command above against any public HTTPS site. Note the certificate subject, the issuer (CA) and the TLS version.