HTTPS vs HTTP
HTTPS vs HTTP
一句话：HTTPS = HTTP + TLS 加密层。同一套协议，只是传输过程被加密和验证了。
它提供三样东西（要说全）：
- 加密—— 中间人看不到内容
- 身份验证—— 证书证明「你连的确实是这个域名的服务器」，防的是中间人冒充；它不防钓鱼：钓鱼站点用自己的域名，照样能拿到合法证书
- 完整性—— 内容被篡改会被发现
握手大致过程：客户端打招呼 → 服务器发证书 → 客户端验证书链 →用非对称加密协商出一个对称密钥 → 之后用对称加密传数据。为什么要混用两种加密？非对称安全但慢，对称快但要先安全地交换密钥 ——所以用非对称来交换对称密钥。这一句是加分点。
端口：HTTP 80，HTTPS 443。
会追问：「HTTPS 慢吗？」—— 握手有额外开销，但TLS 1.3 把握手压到一次往返，而且HTTP/2 和 HTTP/3 只在 HTTPS 上可用—— 多路复用带来的收益通常超过加密的开销。所以「用 HTTPS 会变慢」现在基本不成立。
「有了 HTTPS 就安全了吗？」——不。它只保护传输过程。XSS、SQL 注入、弱口令、越权一个都没解决。
In one line: HTTPS is HTTP plus a TLS layer. Same protocol; the transport is now encrypted and authenticated.
It gives you three things — name all three:
- Encryption — someone in the middle cannot read the contents
- Authentication — the certificate proves “you really are talking to the server for this domain”, which stops a man in the middle from impersonating it. It does not stop phishing: a phishing site uses its own domain and can get a perfectly valid certificate
- Integrity — tampering is detected
Roughly how the handshake goes: client says hello → server sends its certificate → client verifies the chain → they use asymmetric crypto to agree on a symmetric key → everything after that is symmetric. Why mix the two? Asymmetric is secure but slow; symmetric is fast but needs the key exchanged safely first — so you use asymmetric to exchange the symmetric key. That sentence is the bonus point.
Ports: 80 for HTTP, 443 for HTTPS.
Follow-up: “Is HTTPS slow?” — the handshake costs something, but TLS 1.3 gets it down to one round trip, and HTTP/2 and HTTP/3 are only available over HTTPS — the multiplexing usually more than pays for the encryption. So “HTTPS makes it slower” no longer really holds.
“Does HTTPS make me secure?” — no. It protects the transport. XSS, SQL injection, weak passwords and broken authorisation are all still yours to solve.