0

This question may be silly but I've a hard time understanding TLS 1.2 and accessing a website via HTTPS.

I've received a report from a web security tool that my website is not HTTPS and I have to enable TLS 1.2 on the server. As per my understanding to make a website HTTPS I have to add a security certificate to the website and enable HTTPS in my IIS, but as per the suggestion my website becomes HTTPS once I enable TLS 1.2 in server.

My question is: is enabling TLS 1.2 is enough to make a website HTTPS? If yes, are certificates are not required for that? Do I need to enable both TLS 1.2 and IIS level HTTPS?

Improve this question
1
  • HTTPS just means HTTP-over-TLS. TLS is a tunnel. And yes, you need a certificate to enable TLS.
    – user163495
    Commented Aug 28, 2020 at 13:29

1 Answer 1

Reset to default
3

TLS 1.2 is a protocol. HTTPS is HTTP over TLS. While TLS supports some methods to protect the connection without certificates, browsers don't - the certificate is required to make sure that the expected server is reached (i.e. protection against man in the middle attack).

To use HTTPS (and thus TLS) with a browser as a client you need to enable both HTTPS in your server and also provide a certificate. You might additionally restrict the accepted TLS protocol version to TLS 1.2 and better.

Improve this answer
2
  • Ok, so if I'm accessing a URL without browser (WCF service to WCF Service) then do I need to enable HTTPS in server or enabling TLS 1.2 is enough?
    – Jay
    Commented Aug 28, 2020 at 13:39
  • 1
    @Jay: Almost all HTTPS client expect a certificate. But you could write your own client which uses a different method for authentication of the peer, like PSK. Of course, the server would need to support this too and the typical web servers don't.
    – Steffen Ullrich
    Commented Aug 28, 2020 at 13:46

Not the answer you're looking for? Browse other questions tagged .