Catalog
technology#Security#Architecture#Integration#Platform

Hypertext Transfer Protocol Secure (HTTPS)

HTTPS encrypts HTTP traffic using TLS/SSL, ensures server authentication and protects message integrity. It is the standard for secure web and API communication.

HTTPS is a protocol that secures HTTP communication by layering TLS/SSL to provide encryption, authentication and message integrity for web traffic.
Established
Medium

Classification

  • Medium
  • Technical
  • Technical
  • Intermediate

Technical context

Web servers (Nginx, Apache, Caddy)API gateways and reverse proxiesCDNs and load balancers with TLS support

Principles & goals

Encrypt data in transit consistentlyPrioritize strong, up-to-date TLS versions and cipher suitesImplement automated certificate management and renewal
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Misconfigurations (e.g., weak ciphers) can give false security
  • Certificate expiry or loss can interrupt services
  • Trust in compromised CAs or faulty PKI can enable attacks
  • Always use current TLS versions and recommended ciphers
  • Use automated certificate rotation with ACME or internal PKI
  • Consistently enable HSTS, redirects and secure cookie flags

I/O & resources

  • Domain name and DNS records
  • TLS certificates (CA-signed or automated)
  • TLS-capable server or proxy software
  • Encrypted endpoints (HTTPS)
  • Certificate and configuration reports
  • Monitoring data for TLS connections and errors

Description

HTTPS is a protocol that secures HTTP communication by layering TLS/SSL to provide encryption, authentication and message integrity for web traffic. It protects user data in transit, mitigates man-in-the-middle attacks, and is the de facto standard for secure web services and APIs across public and private networks.

✔

  • Protects confidentiality and integrity of transmitted data
  • Increases user trust via browser and platform indicators
  • Prerequisite for many secure web standards and best practices

✖

  • Requires management of certificates and keys
  • Old clients or devices may not support modern TLS standards
  • TLS secures only the transport layer, not application data or authorization logic

  • TLS handshake latency

    Time required to establish a TLS connection; affects page load times.

  • Remaining certificate validity

    Share of certificates approaching expiry and requiring renewal.

  • Share of secure cipher/protocol configurations

    Assessment of configured cipher suites and TLS versions in the fleet.

Public search engine

Search providers deliver results and account features exclusively over HTTPS to protect user data.

Git hosting and web platforms

Platforms such as code hosting and issue trackers use HTTPS for all UI and API endpoints.

Kubernetes API server

The Kubernetes API server uses TLS to secure communication between clients and the cluster.

1

Configure domain and DNS

2

Obtain certificate and store securely

3

Configure server/proxy with TLS (protocols, ciphers, HSTS)

4

Set up automated renewal and monitoring

5

Perform penetration tests and compatibility checks

⚠️ Technical debt & bottlenecks

  • Old TLS configurations that still allow legacy ciphers
  • No automation for certificate rotation implemented
  • Missing centralized inventory of issued certificates
Certificate managementLegacy client compatibilityTLS termination points
  • Only parts of the application use HTTPS while other endpoints remain open
  • TLS enabled but weak ciphers and protocols allowed
  • Not monitoring certificates so expiries go unnoticed
  • Forgetting to correctly configure HTTP-to-HTTPS redirects
  • Storing certificates insecurely or embedding them in code
  • Ignoring TLS compatibility tests for critical clients
Understanding of TLS/SSL and PKI conceptsOperation and configuration of web servers/proxiesAutomation of certificate workflows (ACME, tooling)
Privacy and compliance requirementsAvailability and performance under TLS overheadInteroperability with clients and legacy systems
  • • Requirement for trusted certification authorities
  • • Compatibility requirements of older clients or devices
  • • Organizational processes for key and certificate rotation