Difference between HTTPS and SSL

Question

What is the difference between HTTPS and SSL? I read about them and found following:

• HTTPS: HTTPS is a combination of HTTP with SSL/TLS. It means that HTTPS is basically HTTP connection which is delivering the data secured using SSL/TLS.

• SSL: SSL is a secure protocol that works on the top of HTTP to provide security. That means SSL encrypted data will be routed using protocols like HTTP for communication.

I am wondering where is the difference between these two? Or both are identical?

Ruddle

You may be interested in this similar question: security.stackexchange.com/q/5126/2435 – Schema

Answer 1

The explanation of SSL that you've found is wrong.

SSL (Secure Socket Layer) or TLS (Transport Layer Security) works on top of the transport layer, in your examples TCP. TLS can be used for more or less any protocol, HTTPS is just one common instance of it.

HTTP is an application layer protocol.

In regular, non-encrypted HTTP, the protocol stack can look like this:

• HTTP
• TCP
• IP
• Ethernet

When using HTTPS, the stack looks like this:

• HTTP
• TLS (SSL)
• TCP
• IP
• Ethernet

Ewen

Thanks Anders. So, it means that the HTTPS and SSL(when HTTP is used as Transport layer protocol) are same? – Ruddle

Not really, HTTP is an application protocol. I've updated my answer to clarify. – Ewen

"HTTPS is just on common instance of it" really helped solidify this for me! – Windowsill

For more depth on certificates and weakness of HTTPS, see the SO answers to #856709 – Howie

Answer 2

HTTPS runs over SSL (as it's name suggests, HTTP-over-SSL), not SSL over HTTP. First SSL session is established, then all HTTP data are wrapped into secured SSL packets before sending and after receiving.

Ambert

I got it. I didn't frame my query properly. Thanks. – Ruddle

Answer 3

SSL (Secure Sockets Layer) is a standard security technology to create an encrypted link between a server and a client. This link ensures that all data passed between the server and the client remain private and secure. It was designed to support protocols such as FTP, HTTP, TELNET.

Hypertext Transfer Protocol Secure (HTTPS) or “HTTP Secure,” is an application specific implementation that is a combination of the Hypertext Transfer Protocol (HTTP) with the SSL/TLS. HTTPS is used to provide encrypted communication and secure identification of a server, so that no middle man can intercept the data easily.

As everything in HTTP is in plain text (or encoded) , it is used with SSL/TLS to encrypt it.

Found this link which explains SSL, TLS, HTTPS : http://nexsniper.blogspot.com/2017/11/what-is-ssl-tls-and-https.html

Erzurum

Thanks for the link, it was really helpful! – Villar