SSL/TLS and HSTS, what is that ?

Our websites are made safe with https. That means that we use SSL/TLS. But what is that ? And what is the HSTS extension ?

Posted on
(Last modified on )
3 minutes
459 words
Michée Lengronne
Other languages: Français

The running of SSL/TLS

SSL/TLS is a protocol that provides server identity verification (for instance a web server like Limawi, in that case we speak about https because the protocol to access a web server is called http). This identity verification works with a certificate sent from the server.

Here is the protocol step by step (technical terms are present in the graphs):

  • The client software asks the server its identity
  • The server sends a certificate signed by the certification authority trusted by both the client software and the server to the client software
  • The client software checks if the signature belongs to the certification authority it trusts
  • It sends a request to this certification authority to check if it ensures that the certificate is still valid
  • The client software and the server agree on a session key that will encrypt informations during a limited period (this time passed, another session key will take the place, the details for Limawi are explained in the graphs about the session key)
  • The client software and the server can communicate in a secure way
Diagram displaying the SSL/TLS identity flow

SSL/TLS identity server protocol with Let’s Encrypt

Diagram displaying the SSL/TLS identity flow
Diagram displaying the SSL/TLS session flow

SSL/TLS server session protocol with Let’s Encrypt

Diagram displaying the SSL/TLS session flow

The HSTS extension

The HSTS extension is a http protocol extension (the protocol that loads webpages) reinforcing the SSL/TLS use.

This extension forces the browser to load secure versions of a webpage and all the ressources this page holds (that is to say https versions) in a domain (the base address of a website) that implements it.

If the wanted webpage does not have any secure version, it is not loaded on the browser.

Once the browser accesses a website implementing this extension it keeps in memory that the next webpages wanted on that website must be secured. It can check it even before sending the first request to the website.

A HSTS extension is valid for a limited period and the browser must check at the end of this time if the website always uses this extension to start another period.

Domains (base address of a website) can be preloaded in a database available in your browser. That way the browser knows even before sending the first request of its history to a webpage that it must be secure otherwise it does not load it.

This base is available here: HSTS Preload

With Limawi

With Limawi, the certification authority is Let’s Encrypt.

The session key exchange between the client software and the server is done with the Diffie-Helman protocol that creates a symmetrical session key without exchanging secret elements.

Limawi uses HSTS. The HSTS validity period is 6 months.

References