Unveiling Secure Browsing: From URL to Secure Webpage Rendering

The simple act of typing a URL into your web browser and hitting ‘Enter’ sets off a cascade of complex digital events. In this post, we’ll explore the intricate processes underpinning this activity, focusing specifically on HTTPS – the secure version of the Hypertext Transfer Protocol.

1. The Initial Request:

When you enter a URL like ‘https://www.google.com’ into your browser and hit ‘Enter’, your browser first checks its local cache to see if it already has the IP address associated with the URL. If it doesn’t, it initiates a Domain Name System (DNS) lookup to find it.

2. Local System Calls and Resolv.conf:

The DNS lookup begins at a local level. UNIX-based systems consult the ‘/etc/resolv.conf’ file (or an equivalent file in other systems). This file typically contains the addresses of DNS servers, often those provided by your Internet Service Provider (ISP), and it controls how the system conducts DNS lookups.

3. Contacting Recursive DNS Servers:

If the IP address for the URL isn’t stored locally, your system reaches out to the recursive DNS servers listed in your ‘resolv.conf’ file. These servers undertake the task of resolving the domain name into an IP address.

4. Interaction with Root Name Servers:

Should the recursive DNS server not have the required IP cached, it sets off a series of queries starting with a root name server. The root servers respond with a delegation, which directs the query to the Top-Level Domain (TLD) name servers.

5. TLD and Authoritative Name Servers:

The recursive DNS server then queries the TLD name servers (e.g., .com, .org). These servers don’t have the IP address for the specific domain but they do know where to find the authoritative name servers that do. They send a delegation to these authoritative name servers.

6. Getting the IP Address:

The authoritative name servers can provide the specific mapping between the domain name and its corresponding IP address. They respond to the recursive server with the required IP address, which then passes back to your system.

7. Establishing a TCP Connection:

Armed with the IP address, your system initiates a three-way TCP handshake with the server to establish a reliable connection, essential for data exchange.

8. Enabling Secure Communication with TLS Handshake:

If the website uses HTTPS, an additional step is required before any HTTP requests are made – a TLS (Transport Layer Security) handshake. This process establishes an encrypted connection between your browser and the server, ensuring that all data exchanged is secure.

The TLS handshake involves:

• The client (your browser) sending a “ClientHello” message with its TLS version, cipher settings, and a random byte string.
• The server responding with a “ServerHello” message, selecting the appropriate cipher, and sending its certificate for authentication.
• The client verifying the server’s certificate with the certificate authority to ensure it’s trustworthy. After verification, the client creates a pre-master secret for the session, encrypts it with the server’s public key, and sends it to the server.
• Both the client and the server using the pre-master secret to generate the session-specific encryption keys.

9. Making the Secure HTTP Request:

Upon establishing a secure connection, your system sends an HTTP GET request to the server asking for the contents of ‘www.google.com.’ However, this request and all subsequent data transfers are encrypted with the session key from the TLS handshake, ensuring data privacy and integrity.

10. Processing the HTTP Response:

The server responds with an HTTP response, containing the HTML, CSS, and JavaScript files that make up the webpage. This response is encrypted, and it’s decrypted by your browser using the session key.

11. Rendering the Webpage:

Finally, the browser parses and renders the webpage using the received files. If there are additional resources like images or videos, the browser initiates more secure requests to retrieve them.

To sum up, when browsing with HTTPS, every step from typing a URL to seeing the fully rendered webpage involves an intricate dance of systems and protocols. The addition of the TLS handshake ensures a secure browsing experience, protecting sensitive data from potential threats. This process underscores the sophistication of our modern web infrastructure, taking us from URL to a securely rendered webpage in seconds.