‫Now, HTTP s consists of communication over HTTP within a connection encrypted by TLS transport, layer
‫security or its predecessor, SSL, the Secure Sockets layer.
‫The main motivation for HTTPS is authentication of the visited website and protection of the privacy
‫and integrity of the exchange data.
‫So let's see how a typical encrypted connection between the server and the client is established.
‫The client sends the information that the server needs to communicate with the client using SSL.
‫This information contains the client SSL version numbers, cipher settings and session specific data.
‫The server then sends the information that the client needs to communicate with the server over SSL.
‫The server also sends its own certificate.
‫The client uses the information sent by the server to authenticate the server.
‫So using all data generated in a handshake thus far, the client create the pre master secret for the
‫session encrypted with the server's public key and then sends the encrypted pre master secret to the
‫server.
‫The server uses its private key to decrypt the pre master secret.
‫And both the client and the server perform a series of steps to generate the master secret.
‫Then they use the master secret to generate the session keys, which are symmetric keys used to encrypt
‫and decrypt information exchanged during the SSL session and to verify its integrity.
‫The client sends a separate message indicating that the client portion of the handshake is finished.
‫And the server sends a separate message indicating that the server portion of the handshake is finished.