12

I want to communicate from an embedded device that only has SSL for encryption with an intranet-server that can receive HTTPS.

Will SSL encrypted HTTP string be interpreted as HTTPS? or is there more to HTTPS than just sending a HTTP string over SSL?

Improve this question
1
  • 2
    You can't just "encrypt" a string using SSL and pass it to any webserver's SSL port at-is. SSL is a protocol that involves active handshaking between the sender and receiver, so you have to use an SSL client to talk to an SSL server.
    – Johnny
    Jul 31, 2015 at 1:49

2 Answers 2

Reset to default
24

HTTPS is HTTP over SSL. SSL first connects to the host, so the host name and port number are transferred as clear text. When the host responds and the challenge succeeds, your client will encrypt the HTTP request. This is said, and by putting in mind how the communication between layers in the OSI model occurs:

enter image description here

As SSL acts in the Session layer (5) and HTTP on the Application layer (7), SSL encrypts HTTP request (including the HTTP headers themselves), and since the HTTP request format (simplified) looks like follows:

enter image description here

You can conclude that you are referring to the same notion expressed differently.

Improve this answer
11
  • 5
    I really wanted to upvote you - except for the OSI model part. SSL is definitely NOT on OSI layer 5, since SSL has nothing to do with the OSI model, it lives in TCP/IP. OSI model is irrelevant ;-)
    – AviD ♦
    Jul 30, 2015 at 11:44
  • 1
    @AviD it acts on the fifth layer of the OSI model like TLS too :)
    – user45139
    Jul 30, 2015 at 11:46
  • 1
    In the Internet Protocol Suite, TLS and SSL encrypt the data of network connections in the application layer. In OSI model equivalences, TLS/SSL is initialized at layer 5 (session layer) and works at layer 6 (the presentation layer). en.wikipedia.org/wiki/Transport_Layer_Security
    – Scott
    Jul 30, 2015 at 12:56
  • 1
    @begueradj That's a great picture of OSI. Can you site where it came from, or the article associated with it? I'm interested in reading the article if there is one.
    – dylan7
    Jul 30, 2015 at 19:17
  • 2
    @begueradj I absolutely agree with you on that, except that usually it doesn't help but hinders. That's why I said your first 3 sentences are great, the rest is misleading and confusing (besides being technically wrong...)
    – AviD ♦
    Jul 31, 2015 at 9:57
10

HTTPS is just HTTP going over SSL - the HTTPS just signifies to the browser (or other network stack) that the HTTP protocol needs to be tunneled over an SSL channel. There is nothing else "special" about HTTPS...

Well, except the CONNECT method.
To be specific, the CONNECT method is not anything special in HTTPS, it is part of the HTTP spec. This method supports tunneling an SSL channel through an HTTP proxy. Without it, there would be no way to initiate a secure channel between the browser and the webserver, without the proxy being able to view and tamper with the connection. CONNECT enables the SSL handshake via the proxy.

But, if you are not using a proxy between your device and the server, then there should be no practical difference.

Improve this answer
3
  • Maybe add that HTTPS usually runs on port 443?
    – inf
    Jul 30, 2015 at 12:50
  • The CONNECT method isn't even part of HTTPS, it's part of HTTP proxying.
    – user253751
    Jul 31, 2015 at 6:25
  • @immibis yes, that is what I meant when I said "the CONNECT method is not anything special in HTTPS, it is part of the HTTP spec." Did I miss anything there?
    – AviD ♦
    Jul 31, 2015 at 9:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .