HTTPS

Jan 1, 0001

Definition

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP designed to provide secure communication over a computer network. It uses Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL), to encrypt data exchanged between a client and a server, ensuring data integrity, confidentiality, and authentication. HTTPS is essential for protecting sensitive information such as login credentials, personal data, and payment details from eavesdropping and man-in-the-middle attacks.

Secure Settings Example

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
    
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

Insecure Settings Example

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers 'RC4:DES-CBC3-SHA';
    ssl_prefer_server_ciphers off;
    
    # Missing HSTS header
}