HTTPS
HTTP transported inside a TLS session — the modern default for web traffic.
HTTPS is HTTP carried inside a TLS session. It is not a separate protocol: the request/response semantics are exactly the same as HTTP, but every byte travels through an encrypted, authenticated TLS channel on TCP/443 instead of TCP/80. That gives the request confidentiality, integrity against in-path tampering, and a verified server identity tied to the domain name in the URL.
The server's certificate is what binds HTTPS to a specific name. During the TLS handshake the client sends the hostname via SNI, the server returns a certificate whose subject or SAN must match that hostname, and the browser validates the chain against its trusted CA store. If anything fails — expired certificate, unknown CA, hostname mismatch, weak protocol version — the browser blocks the connection rather than degrading to plain HTTP. Modern browsers treat HTTPS as the baseline: HSTS forces clients to always use HTTPS for a domain, mixed-content rules block plaintext sub-resources on an HTTPS page, and many features (HTTP/2, HTTP/3, service workers, secure cookies) are only available over HTTPS.
Key Points
- HTTP semantics inside a TLS-encrypted channel
- Default port
443 - Certificate must match the URL's domain via subject or SAN
- Browser blocks the connection on validation failure
- HSTS pins a domain to HTTPS-only access
- Required for HTTP/2, HTTP/3 and many modern web features