How does webserver informs the browsers of the https capability?

Question

How does webserver informs the browsers of the https capability?

• if we type in microsoft.com (which is a http request by default) firefox fetches/the server serves the following page https : // www.microsoft.com/en-in/ .The original request is in http.

• we see a Http get request for http : //microsoft.com/ with Upgrade-Insecure-Requests: 1 flag (the clients willingness to go to a secured connection)

• next we see a http 301 moved permanently. this packet contains the location field as http: // www.microsoft.com /

• next we see the client starting out a TLS handshake to start out the https session and eventually get the https page

1. where can we see the server informing the client of the https capability or redirecting for https port 443?

2. can we suppress the Upgrade-Insecure-Requests flag so that we get a http response?(assuming the server doesnot automatically redirect to https)

attached is a wirehark capture. filter using the following

(http contains microsoft) or (ssl contains microsoft) 

Answer 1

In this case, it's a pretty simple series of HTTP redirections:

┌─[jamesph@ilmr] - [~] - [Tue Jan 24, 11:45]
└─[$]> http --head 'http://microsoft.com'
HTTP/1.1 301 Moved Permanently
Content-Length: 148
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Jan 2017 19:45:48 GMT
Location: http://www.microsoft.com/
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET

┌─[jamesph@ilmr] - [~] - [Tue Jan 24, 11:45]
└─[$]> http --head 'http://www.microsoft.com'
HTTP/1.1 302 Moved Temporarily
Connection: keep-alive
Content-Length: 0
Date: Tue, 24 Jan 2017 19:45:56 GMT
Location: http://www.microsoft.com/en-us/
Server: AkamaiGHost
X-CCC: US
X-CID: 2

┌─[jamesph@ilmr] - [~] - [Tue Jan 24, 11:45]
└─[$]> http --head 'http://www.microsoft.com/en-us/'
HTTP/1.1 301 Moved Permanently
Connection: keep-alive
Content-Length: 0
Date: Tue, 24 Jan 2017 19:46:03 GMT
Location: https://www.microsoft.com/en-us/
Server: AkamaiGHost
Set-Cookie: akacd_OneRF=1493063163~rv=66~id=28df10e9d3a3627dfc38acff7feb884a; path=/; Expires=Mon, 24 Apr 2017 19:46:03 GMT
X-CCC: US
X-CID: 2

(I'm using httpie, a utility that's like an improved version of curl for cli usage.)

http://microsoft.com 301 redirects to http://www.microsoft.com, which 302 redirects to http://www.microsoft.com/en-us/, which 301 redirects to https://www.microsoft.com/en-us/.

In general, HTTP redirects are how many websites get users onto https. Tools like sslstrip can sometimes foil these attempts, since the initial connection can be MitMed because it's not protected by TLS, which is why sites are increasingly starting to use HSTS headers, at which point the browser stores the information that the site should be accessed over https and sends the request there from the start (rather than assuming http when the protocol isn't given).