I understand that CAs issue certificates based on common names (CNs) like www.amazon.com and that certs are not based on URLs like www.amazon.com/stuff.

How is it that when I go to www.amazon.com, it is not secured and when I press Log In, the connection is now SSL-secured? I could understand if the login link redirected me to a site like login.amazon.com where there was an SSL cert for the sub-domain... But the login page on Amazon starts with www.amazon.com which is not secured when you go to it without logging in.

This is the exact login link:


2 Answers 2


When you access http://www.amazon.com and click Login, it redirects you to https://www.amazon.com which is secure.

Note: This is susceptible to sslstrip and they should be forcing SSL/TLS using HSTS.


Most times, SSL is enabled for the whole website, but depending on "which part" of the website your browser requests, your browser stays on the SSL version, or gets politely asked by the server to go to http instead, and then forms the same request on http again.

With "part" I (and you) mean the path part of the url you requested.

Certificates are used for SSL, yes, but they do not have to be used, a website can offer http and https service the same time. Check wikipedia as an example.

Two example traffics

First the not logged in request to the main site (cropped for better readability):

GET / HTTP/1.1
Host: amazon.com

Server sees the main site is being requested by someone not logged in, in https and sends the response:

HTTP/1.1 301 Moved Permanently
Location: http://amazon.com/

note the http.

Now the request for your login url:

GET /ap/signin/and_so_on HTTP/1.1
Host: amazon.com

Server sees the login site being requested, performs the login, and sends the response:

HTTP/1.1 200 OK
(site content)

(successful login, no redirect)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .