How Does HTTPS Work?

In this article I am going to discuss about HTTP and HTTPS protocol. HTTPS is a actually is a top up of HTTP protocol with SSL/TSL security layer. i.e. HTTPS=HTTP+SSL/TSL.

Lets before discussing more it take scenario. Whenever you went for any website like banking, e-commerce etc. when you clicked on these website you might be focus on the browser that suddenly your browser address bar says HTTPS instead of HTTP that is because of your information is safe. The website you are working with has made sure that no one can steal your information like credit card information, mobile number and other crucial information about you.

What is a HTTPS?
HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) or HTTP over SSL is a web protocol developed by Netscape. It is not a protocol but it is just the result of layering the HTTP on top of SSL/TSL (Secure Socket Layer/Transport Layer Security). HTTPS is the secure version of HTTP it means all communications between your browser and the website are encrypted. HTTPS is often used to protect highly confidential online transactions like online banking and online shopping order forms.

Web browsers such as Internet Explorer, Firefox and Chrome also display a padlock icon in the address bar to visually indicate that a HTTPS connection is in effect.

How Does HTTPS Work?
HTTPS pages typically use one of two secure protocols to encrypt communications - SSL (Secure Sockets Layer) or TSL (Transport Layer Security). Both the TSL and SSL protocols use what is known as an 'asymmetric' Public Key Infrastructure (PKI) system. An asymmetric system uses two 'keys' to encrypt communications, a 'public' key and a 'private' key. Anything encrypted with the public key can only be decrypted by the private key and vice-versa.

The 'private' key should be kept strictly protected and should only be accessible the owner of the private key. In the case of a website, the private key remains securely ensconced on the web server. Conversely, the public key is intended to be distributed to anybody and everybody that needs to be able to decrypt information that was encrypted with the private key.

@ImageSource-https://www.instantssl.com/images/http-vs-https.png

Basic Work Flows of HTTPS-
Step 1- User request any a website which using HTTPS certificate client open url as https://web-page

Step 2- Then server immediately responds to the initial connection by offering a list of encryption methods the webserver supports.

Step 3- Then client selects a connection method, and the client and server exchange certificates to authenticate their identities.

Step 4- Now web server and client exchange the encrypted information after ensuring that both are using the same key, and the connection is closed.

What is a HTTPS SSL certificate?
When you request a HTTPS connection to a webpage, the website will initially send its SSL certificate to your browser. This certificate contains the public key needed to begin the secure session. Based on this initial exchange, your browser and the website then initiate the 'SSL handshake'. The SSL handshake involves the generation of shared secrets to establish a uniquely secure connection between yourself and the website.

When a trusted SSL Digital Certificate is used during a HTTPS connection, users will see a padlock icon in the browser address bar. When an Extended Validation Certificate is installed on a web site, the address bar will turn green.

Why Is an SSL Certificate Required?
All communications sent over regular HTTP connections are in 'plain text' and can be read by any hacker that manages to break into the connection between your browser and the website. This presents a clear danger if the 'communication' is on an order form and includes your credit card details or social security number. With a HTTPS connection, all communications are securely encrypted. This means that even if somebody managed to break into the connection, they would not be able decrypt any of the data which passes between you and the website.


Benefits of HTTPS over HTTP-

• User information, like credit card numbers, mobile numbers etc. is encrypted and cannot be intercepted
• Users can verify you are a registered business and that you own the domain
• Users are more likely to trust and complete purchases from sites that use HTTPS

SSL For Tomcat

Certificates

For IIS we use .pfx files and this must be supplied by the customer.

For Tomcat we require a p7b certificate and if it is not received from the customer, you can create own.

1. Launch IIS and select the server name, then Server Certificates.

2. Right-click on the certificate and select Export.

3. Export the .pfx file to the root of the drive where ProjectDox resides, choose a password and confirm the password. You will need this password during the Tomcat SSL process.

4. Launch the mmc.exe on the web server.

5. Choose File, Add/Remove Snap-in and choose Certificates.

6. Click the Add button in the middle of the screen.

7. Choose the third radio button, Computer account then click Next.

8. Continue with the default radio, Local computer (the computer this console is running on), then click Finish.

9. Expand Personal, select Certificate, right mouse click on the certificate.

10. Choose All Tasks, Export.

11. Click Next on the Welcome to the Certificate Export Wizard.

12. Click the radio for Cryptographic Message Syntax Standard for PKCS #7 Certificates (.P7B)

13. Place a checkmark for Include all certificates in the certification path if possible, click Next.

14. Use the Browse button and navigate to the root drive where ProjectDox is installed and save the file as a .p7b file.

15. You will be returned to the File name screen, click Next.

16. Once the process is complete, you will see the settings you specified, click Finish.

You now have a .pfx with a known password and a .p7b certificate to continue on to the next step.

Installation DOS Commands

Create the Keystore for Tomcat

Convert .pfx certificate file to JKS:

1. Launch a command prompt on the web server.

2. From Java folder (eg. C:\Program Files\Java\jre7\bin) run the following command:

Sample: keytool -importkeystore -srckeystore e:\certificate.pfx -srcstoretype pkcs12 -destkeystore destcert.jks -deststoretype JKS -storepass <yourpassword>

Actual: keytool -importkeystore -srckeystore e:\incoming\lorassl\avolvecloudsslcom.pfx -srcstoretype pkcs12 -destkeystore pdtomcert.jks -deststoretype JKS -storepass MyPassword

3. The result will give you the keyAlias value.

Entry for alias le-c5a08b67-625c-4184-8769-59eca73b6b55 successfully imported.

Import command completed:  1 entries successfully imported, 0 entries failed or

cancelled

NOTE:  In the above command, we did not provide a path for the –destkeystore parameter therefore, the JKS file is created in Java bin folder.

4. Copy the C:\Program Files\IGC\Tomcat 8 For Brava\conf\your_p7b_file.p7b into C:\Program Files\Java\jre7\bin.

5. Import certificate into JKS file (which is the keystore) using this command:

Sample: keytool -import -trustcacerts -alias alias_from_jks_file -file your_p7b_file.p7b -keystore destcert.jks -storepass <yourpassword>

Actual: keytool -import -trustcacerts -alias le-c5a08b67-625c-4184-8769-59eca73b6b55 -file ssl_certificate.p7b -keystore pdtomcert.jks -storepass <yourpassword>

Edit Apache Tomcat server.xml

1. Copy destination JKS file to C:\Program Files\IGC\Tomcat 8 For Brava\conf folder.

2. Before changes are made to the server.xml file, save the original file as server.xmlOrig.

NOTE:  If for any reason you need to revert to non SSL, activating the original file will make it very easy.

3. Edit C:\Program Files\IGC\Tomcat 8 For Brava\conf\server.xml You can skip a-d if you copy the server.xml file from \ProjectDox\Integration\BravaPlugin\JP folder and edit the following 2 values, this example is configured for SSL.

keystorePass="<<KEYSTOREPASSWORD>>"
keyAlias="<<KEYALIAS>>"

4. Uncomment the following section:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"

               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"

               clientAuth="false" sslProtocol="TLS" />

5. Update Tomcat to use newer TLS protocols by replacing sslProtocol=”TLS” with sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"

6. Add new keys to that section:

 <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"

             maxThreads="150" SSLEnabled="true" scheme="https" secure="true"

clientAuth="false" sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"

keystoreFile="${catalina.base}/conf/pdtomcert.jks"               

keystorePass=”XXXXXXXXXX”

keyAlias=”XXXXXXXXXXXXXXXXXXXX”

ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,

                    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,

                    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,

                    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,

                    TLS_ECDHE_RSA_WITH_RC4_128_SHA,

                    TLS_RSA_WITH_AES_128_CBC_SHA256,

                    TLS_RSA_WITH_AES_128_CBC_SHA,

                    TLS_RSA_WITH_AES_256_CBC_SHA256,

                    TLS_RSA_WITH_AES_256_CBC_SHA,

                    SSL_RSA_WITH_RC4_128_SHA"

 />

7. Save the server.xml file.

Apache Tomcat Logging

To turn off the logs in Tomcat that create excessive large files named localhost_access_log, comment out the following line:

<Valve className=”org.apache.catalina.valves.AccessLogValve”   directory=”logs” prefix=”localhost_access_log.” Suffix=”.txt” pattern=”%h %l %u %t &quot;%r&quot; %s %b” />

Restart Apache Tomcat

1. Stop the Apache Tomcat Service on the web server.

2. Start the Apache Tomcat Service on the web server.

3. Test viewing file from within ProjectDox application.