VMware ESXi and vSphere Cluster Management

HTTPS: Secure Web Communication with HTTP and TLS

Learn how HTTPS uses TLS to protect web traffic, including encryption, certificates, TCP port 443, browser security indicators, and common troubleshooting issues.

HTTPS is the secure form of web communication. It uses the familiar HTTP application protocol together with Transport Layer Security (TLS) to protect data exchanged between a web client and a web server across an otherwise untrusted network.

This lesson explains what HTTPS protects, how a browser establishes an HTTPS connection, why TCP port 443 matters, how certificates and browser indicators work, and what common HTTPS errors mean.

What Is HTTPS?

Hypertext Transfer Protocol Secure (HTTPS) is HTTP carried over TLS. HTTP still defines how a client requests resources and how a server responds; TLS provides the protected communication channel around that exchange.

The two endpoints are usually:

  • Client: The endpoint that initiates the request, commonly a web browser.
  • Web server: The endpoint that hosts a website or web application and responds to HTTP requests.

HTTPS protects communication between these endpoints while their traffic crosses networks that may be observable or controlled by other parties.

Why Ordinary HTTP Needs Protection

Traditional HTTP sends requests and responses without encryption. A network observer positioned along the path may be able to read the contents of the exchange and, in some situations, modify traffic.

Readable HTTP traffic can expose sensitive information such as:

  • Login usernames and passwords
  • Payment-card details
  • Session cookies and other session data
  • Private form submissions
  • Searches, navigation history, and requested content

For example, when a user submits a login form over HTTPS, TLS encrypts the HTTP request while it travels between the browser and the server. This reduces the ability of network observers to read the credentials in transit.

HTTP Compared with HTTPS

Characteristic | HTTP | HTTPS

Traffic protection | Normally readable in transit | Protected by TLS encryption and integrity checks

TLS usage | None by itself | HTTP exchange occurs within a TLS-protected channel

Default TCP port | 80 | 443

URL scheme | http | https

Typical browser indication | No HTTPS security indicator | Lock or comparable security indicator when checks succeed

Appropriate use cases | Non-sensitive testing or controlled situations; not suitable for private web traffic | The normal choice for websites, applications, forms, logins, and content delivery

HTTPS does not change HTTP methods, status codes, headers, or resource concepts. It secures the transport of the HTTP exchange rather than replacing HTTP's application semantics.

How TLS Protects HTTPS Traffic

Transport Layer Security (TLS) is the protocol that establishes security for HTTPS. It provides three important outcomes:

  • Confidentiality: Encryption transforms data so unauthorized network observers cannot read it easily.
  • Integrity: TLS detects changes to protected data, helping prevent undetected modification while the data is in transit.
  • Server authentication: A digital certificate helps the client validate the identity associated with the server and its public key.

A secure channel is a protected communication path established between endpoints over an otherwise untrusted network. After TLS establishes this channel, HTTP requests and responses travel inside it.

Digital Certificates

A digital certificate is a credential used during TLS to identify a server and support validation of its public key. The browser checks information such as whether the certificate is valid for the requested hostname, whether it is within its validity period, and whether its issuing chain is trusted.

Certificate validation supports server identity authentication, but it does not guarantee that the organization is honest, that its content is safe, or that its business practices are good.

Conceptual HTTPS Communication Flow

  1. The browser, acting as the client, connects toward the web server.
  2. The client and server perform a TLS security negotiation, agreeing on security parameters and establishing shared protection.
  3. The server presents a digital certificate.
  4. The client validates the certificate and checks whether it can trust the server identity for the requested hostname.
  5. When the checks succeed, a protected TLS channel is established.
  6. The browser sends HTTP requests and receives HTTP responses within that protected channel.

These operations normally happen automatically and are largely invisible to the user. An HTTPS address does not by itself guarantee success: the TLS negotiation and certificate validation must also complete successfully.

HTTPS URLs and TCP Port 443

The leading portion of a URL is its URL scheme. The https scheme tells the browser to access the resource using HTTPS.

HTTPS uses TCP port 443 by default. When a URL uses the https scheme without an explicit port, the browser normally assumes port 443.

URL | Port used | Explanation

https://example.com | 443 | The browser uses the default HTTPS port because no port is written.

https://example.com:443 | 443 | The URL explicitly states the same default port.

https://example.com:8443 | 8443 | The browser attempts HTTPS on a nondefault port specified by the URL.

Therefore, https://example.com and https://example.com:443 normally identify the same HTTPS port choice, although the second URL makes that choice explicit.

What the Browser Security Indicator Means

When an HTTPS connection is active and certificate checks have not produced a blocking error, browsers commonly display a lock or another site-security indicator near the address.

The indicator broadly communicates that:

  • The connection to the site is using HTTPS.
  • The browser's certificate checks did not produce a blocking error.

A lock icon does not independently prove that a site is trustworthy, legitimate, harmless, or operated by the organization a user expects. A deceptive website can obtain a valid certificate for its own domain. Users must still check the hostname, avoid suspicious requests, and evaluate the site's legitimacy.

When HTTPS Is Used

HTTPS was once emphasized mainly for sensitive pages, such as sign-in and payment pages. Modern websites commonly use HTTPS across the entire site instead.

Full-site HTTPS protects more than passwords and payment details. It can also protect the contents and metadata of web requests in transit, including:

  • Search terms submitted to the site
  • Navigation between pages
  • Cookies and session information
  • Content requests and viewed resources
  • Private forms and application actions

Using HTTPS consistently also avoids switching users between protected and unprotected parts of the same site.

Performance and Resource Considerations

TLS introduces computational and protocol overhead compared with unencrypted HTTP. The endpoints must negotiate security, perform cryptographic operations, validate certificates, and protect application data.

Modern deployments commonly accept this cost because the security benefits are significant and TLS implementations have become mature and efficient. Connection reuse, optimized cryptographic operations, and improved protocol behavior help reduce the practical impact of TLS overhead.

Troubleshooting HTTPS Problems

“The connection is not private” or an Invalid Certificate Warning

This symptom means that HTTPS was requested, but certificate validation did not complete successfully. Common causes include:

  • An expired certificate
  • A certificate name that does not match the requested hostname
  • A certificate chain that the device does not trust
  • An incorrect device date or time

Using an https URL is not enough. TLS certificate validation must succeed for the browser to treat the connection as normally protected.

The HTTPS Site Does Not Load on the Default Address

Check the relationship between the URL and TCP port 443. Possible causes include:

  • A firewall or access-control policy blocks TCP port 443.
  • No HTTPS service is listening on the target host.
  • The service uses a nondefault HTTPS port, such as 8443, which must be written explicitly in the URL.

A Lock Icon Is Mistaken for Proof of a Safe Website

The browser indicator describes transport security and certificate status. It does not evaluate every aspect of the site's content, ownership, business practices, or intent. A site can use valid HTTPS and still be deceptive or malicious.

Exam-Relevant Notes

  • HTTPS is HTTP protected by TLS.
  • TLS provides confidentiality, integrity protection, and server identity authentication mechanisms.
  • HTTPS normally uses TCP port 443; ordinary HTTP normally uses TCP port 80.
  • The browser assumes port 443 when an https URL omits the port.
  • A certificate warning indicates a TLS validation problem, even when the URL begins with https.
  • A lock icon indicates protected HTTPS transport with no blocking certificate error; it does not prove that the website is trustworthy.
  • HTTPS protects HTTP traffic; it does not replace HTTP methods, requests, responses, or status codes.

Summary

HTTPS secures web communication by carrying HTTP through TLS. The TLS-protected channel encrypts data, detects unauthorized modification, and uses certificates to help authenticate the server. Browsers normally use TCP port 443 for HTTPS and indicate successful protection with a lock or comparable symbol, but that symbol is not a complete trust judgment. Today, HTTPS is generally used across entire websites so that logins, searches, cookies, navigation, and content requests receive protection in transit.

Continue with the HTTPS reference lesson for a concise review of the same core concepts.