2 added certs section
source | link

Most times, SSL is enabled for the whole website, but depending on "which part" of the website your browser requests, your browser stays on the SSL version, or gets politely asked by the server to go to http instead, and then forms the same request on http again.

With "part" I (and you) mean the path part of the url you requested.

Certificates are used for SSL, yes, but they do not have to be used, a website can offer http and https service the same time. Check wikipedia as an example.

Two example traffics

First the not logged in request to the main site (cropped for better readability):

GET / HTTP/1.1
Host: amazon.com

Server sees the main site is being requested by someone not logged in, in https and sends the response:

HTTP/1.1 301 Moved Permanently
Location: http://amazon.com/

note the http.

Now the request for your login url:

GET /ap/signin/and_so_on HTTP/1.1
Host: amazon.com

Server sees the login site being requested, performs the login, and sends the response:

HTTP/1.1 200 OK
(site content)

(successful login, no redirect)

Most times, SSL is enabled for the whole website, but depending on "which part" of the website your browser requests, your browser stays on the SSL version, or gets politely asked by the server to go to http instead, and then forms the same request on http again.

With "part" I mean the path part of the url you requested.

Two example traffics

First the not logged in request to the main site (cropped for better readability):

GET / HTTP/1.1
Host: amazon.com

Server sees the main site is being requested by someone not logged in, in https and sends the response:

HTTP/1.1 301 Moved Permanently
Location: http://amazon.com/

note the http.

Now the request for your login url:

GET /ap/signin/and_so_on HTTP/1.1
Host: amazon.com

Server sees the login site being requested, performs the login, and sends the response:

HTTP/1.1 200 OK
(site content)

(successful login, no redirect)

Most times, SSL is enabled for the whole website, but depending on "which part" of the website your browser requests, your browser stays on the SSL version, or gets politely asked by the server to go to http instead, and then forms the same request on http again.

With "part" I (and you) mean the path part of the url you requested.

Certificates are used for SSL, yes, but they do not have to be used, a website can offer http and https service the same time. Check wikipedia as an example.

Two example traffics

First the not logged in request to the main site (cropped for better readability):

GET / HTTP/1.1
Host: amazon.com

Server sees the main site is being requested by someone not logged in, in https and sends the response:

HTTP/1.1 301 Moved Permanently
Location: http://amazon.com/

note the http.

Now the request for your login url:

GET /ap/signin/and_so_on HTTP/1.1
Host: amazon.com

Server sees the login site being requested, performs the login, and sends the response:

HTTP/1.1 200 OK
(site content)

(successful login, no redirect)

1
source | link

Most times, SSL is enabled for the whole website, but depending on "which part" of the website your browser requests, your browser stays on the SSL version, or gets politely asked by the server to go to http instead, and then forms the same request on http again.

With "part" I mean the path part of the url you requested.

Two example traffics

First the not logged in request to the main site (cropped for better readability):

GET / HTTP/1.1
Host: amazon.com

Server sees the main site is being requested by someone not logged in, in https and sends the response:

HTTP/1.1 301 Moved Permanently
Location: http://amazon.com/

note the http.

Now the request for your login url:

GET /ap/signin/and_so_on HTTP/1.1
Host: amazon.com

Server sees the login site being requested, performs the login, and sends the response:

HTTP/1.1 200 OK
(site content)

(successful login, no redirect)