Introduction
If you are a developer, you probably know what an SSL certificate is. If you don't know what it is, don't worry. An SSL certificate is a must-have on any website. It lets your web browser connect to a web server securely. SSL stands for Secure Sockets Layer, and it is a digital certificate that allows for an encrypted connection.
But let's back it up a bit. First, we need to know what lets a web browser and a webserver connect. To connect with a website, we need HTTP.
What is HTTP?
HTTP stands for Hypertext Transfer Protocol and this protocol is used to transfer data from the web servers to web browsers. So if you ever visit a website you can notice the protocol being added at the beginning of the web address. So for example http://www.website.com. This protocol is used to view different web pages on the internet.
By default in standard HTTP, all of the information is sent in clear text. What this means is when you type something, it gets sent over the public internet which means that hackers can view it, because it's all sent over in clear text.
This isn't a problem, that is if you only browse a website, but if there are any passwords involved, or any other personal information, such as credit card information, then a hacker could easily get that info. Due to the fact it's being sent over the public internet, a hacker could listen in as the data is being transferred and could steal it.
If you ever have to type in personal information, you should always check if you have a secure connection. And for you to have a secure connection, you would need to use HTTPS.
What is HTTPS?
HTTPS is HTTP, but secure. That's why there is an S added. Hypertext Transfer Protocol Secure. What this does is encrypt the data that is being retrieved by HTTP. It lets all of the data that is being transferred between the server and the computer secure. The way it does that is by making the data impossible to read by encryption algorithms that mix up the data that's being transferred.
So whenever you are on a site and you have to enter a password or some credit card information, make sure the web address looks like this - https://www.website.com. This means that the data that you pass in will be protected. You can also notice a padlock to the left of the web address, which also indicates you are using a secure HTTP.
Thanks to the encryption algorithms the data we put in comes out all scrambled up so that hackers can't understand and decrypt it.
HTTPS secures the data thanks to a protocol called:
SSL
SSL stands for Secure Sockets Layer and it is a protocol that's used to establish security on the internet. But how exactly does SSL work? Well, it uses public-key encryption to secure data.
What this means is when a computer connects with a website that is using SSL, the computer's web browser will ask the website to say who it is or identify itself. Then the webserver will send the computer a copy of the SSL certificate it has.
An SSL certificate is a small digital certificate that is used to validate the identity of a website. Or in other words, this lets your computer know that the website you're visiting is reliable and trustworthy.
So then the browser of the computer can check if it trusts the certificate and if it does it will send a message to the web server, to which then the web server will respond with a response so that an SSL session can begin.
Most SSL certificates have to be paid for, but there are also some free ones, for example:
Let's Encrypt
Let’s Encrypt is a Certificate Authority (CA) that provides an easy way to obtain and install free SSL certificates, thereby enabling encrypted HTTPS on web servers. You could check this post out on How To Secure Nginx with Let's Encrypt on Ubuntu so that you can get a little bit more familiar with Let's Encrypt.
Conclusion
This may seem confusing at first, but it's best to get to know how the internet actually works and the different protocols that are out there. If you notice almost all of the sites nowadays have HTTPS instead of HTTP, even though there isn't any data to be transferred between servers, and that's because Google has started flagging websites as Not Secure because they aren't protected with SSL.
I hope that this post has helped you learn a little bit more about these protocols that you use daily and how they work.