My boss is asking me to prove that HTTPS really encrypts the information. How can I do that?
On a basic level, you can use a packet inspector or simple port forwarding proxy. Perhaps Wireshark will inspect the packets easily enough.
You should quickly be able to find that the HTTP traffic is plain text, while the HTTPS is binary gibberish. (with the exception of the hostname)
However, this only proves that the connection is obfuscated. It does not prove encryption or security. Specifically it does nothing to show immunity to MiTM.
Fortunately, the browser does all this for you. If a modern browser tries to connect to an HTTPS web page, it will verify the following:
- Strong enough hash algorithms for the certificates involved.
- Strong enough encryption algorithms. (i.e. it is actually encrypted)
- Certificate chain issued by trusted Certificate Authority(s) (i.e. CA who verifies domain ownership prior to issuing their certificates)
- Non-expiry of the certificates.
- Matching hash values means there will be no MiTM.
While your boss may like to see the wireshark gibberish comparing HTTP to HTTPS, a stronger test is to quite simply visit the HTTPS site with a modern browser.
Be sure the browser has not been pre-configured to ignore the warning. (i.e. test from multiple computers and smartphones)
If you plan to continue HTTPS permanently (which you should), a wise precaution would be to force redirect all HTTP visits to the HTTPS site, because you cannot guarantee that all visitors will include the
https:// prefix when visiting your site.