2. Ports and Protocols: SSH, HTTP, HTTPS, FTP/SFTP and DNS
2.4 HTTPS and TLS Basics – Port 443
HTTPS mhanje HTTP + TLS. TLS teen goshti deto: confidentiality (गोपनीयता – dusra vachu shakat nahi), integrity (अखंडता – madhe koni badal karu shakat nahi) aani server authentication (certificate mule "ha kharach example.com aahe").
Browser Server
| ClientHello (TLS versions, cipher suites, random) -->|
|<-- ServerHello + Certificate (public key, signed by CA)|
| Browser verifies certificate: name, expiry, CA chain |
| Key exchange (ECDHE) -> both derive the same |
| session key; no key is ever sent in clear |
|<========= encrypted HTTP (symmetric, e.g. AES-GCM) ===>|
| Term | Meaning |
|---|---|
| Certificate | Server's public key + domain name, signed by a Certificate Authority (CA) |
| CA | Trusted organisation that signs certificates (for example Let's Encrypt) |
| Symmetric encryption | Same key encrypts and decrypts – fast, used for the actual data |
| Asymmetric encryption | Public/private key pair – used for identity and key exchange |
| TLS 1.2 / 1.3 | Current secure versions; SSL 2/3 and TLS 1.0/1.1 are obsolete |
curl -vI https://example.com 2>&1 | grep -E "SSL|TLS|subject|expire"
openssl s_client -connect example.com:443 -servername example.com </dev/null | head -20
Why this matters for security
HTTPS protects data in transit, not the application itself – a site with a valid padlock can still have SQL injection. Expired or self-signed certificates train users to click through warnings, which is exactly what phishing and MITM attackers want. In Part 6 we add free certificates with Certbot.
Ravindra Bagale's Tip
Khup students mhantat "padlock aahe mhanje website safe aahe". Nahi mitrano! Padlock fakt connection encrypted aahe he sangto. Phishing sites pan HTTPS vaprtat. Domain naav nit vacha – paypa1.com aani paypal.com madhe farak aahe.
Practice task
Run the openssl s_client command above against any public HTTPS site. Note the certificate subject, the issuer (CA) and the TLS version.