HTTP, HTTPS & Web Page Retrieval

HTTP is a protocol for requesting and transferring web resources. HTTPS protects HTTP using TLS. It encrypts data in transit, detects modification and authenticates the requested domain through a certificate chain trusted by the browser.

What HTTPS does and does not establish

A valid certificate for shop.example authenticates that domain. It does not prove the business is honest. An attacker can obtain a valid certificate for a lookalike domain. Read the full intended domain and treat unexpected requests for passwords or payments with care. Browser security indicators vary; a padlock is not a guarantee against phishing.

A certificate authority checks control of a domain for a domain-validated certificate. Some certificate types involve additional organisation checks, but business-identity checking is not universal. The browser checks the certificate's domain, validity period and trust chain. The handshake establishes symmetric keys for protecting the connection; detailed handshake algorithms are outside this lesson.

Worked journey: opening a weather page

1. The user enters a URL. The browser identifies its protocol, host and resource path.
2. DNS resolves the host name to an IP address, unless a suitable answer is already cached.
3. The browser establishes a connection; HTTPS also establishes the protected TLS connection.
4. It sends an HTTP request for the resource.
5. The server returns a response containing the page's HTML or another resource.
6. The browser interprets the HTML, requests linked CSS/images/scripts as needed, and renders the page.

DNS locates a server; it does not deliver the whole web page. The browser renders the content; the search engine is not needed when a URL is entered directly.

Independent explanation

A link in an unexpected email opens an HTTPS page asking for a bank password. Explain why encrypted transport is useful but insufficient to establish that the page belongs to the bank. Name a check that addresses the actual risk.

Written practice and self-review

Browsers display connection-security information; its icon and presentation vary.

1. Explain the three core security guarantees provided by HTTPS (Confidentiality / Encryption, Authentication, and Data Integrity).
2. Describe how a web browser uses a digital certificate and a Certificate Authority (CA) to verify that a web server is authentic.

Write an explanation before checking the theory. Check that each claim answers the question, uses the correct concept and explains why it applies. Discuss uncertain points with a teacher. The structured exercise below checks specific facts; it does not automatically mark this explanation.