If a server posts a message via HTTPS to another server that does not have HTTPS enabled, will that message still have been sent encrypted?

For example, a message from https://example.com to http://anotherexample.com.

  • 3
    No, it will not.
    – gowenfawr
    Mar 29, 2015 at 23:42

1 Answer 1


No. There's no such thing as a message sent from https://example.com to anywhere; a message is sent from a device, not a URL. A user visiting your site sends messages from their computer to your server, and your server sends messages to their computer; the https in the URL means that they initiated that connection with the HTTPS protocol, and your server (when it receives HTTPS messages) is configured to respond with replies using the HTTPS protocol. If you initiate a connection to http://anotherexample.com from your server, you are initiating a connection from your server to the host of anotherexample.com using the HTTP protocol, which is not encrypted -- it's irrelevant that a user had previously connected to your server with HTTPS, because that's a different connection.

  • Ah, duh. I wasn't thinking about it that way. Thank you.
    – Jerreck
    Mar 29, 2015 at 23:50
  • If a JavaScript page received via https were to encrypt some material before sending it via http post, and the nature of the request made replay attacks irrelevant, could such an approach be secure?
    – supercat
    Apr 3, 2015 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .