3 ms·
HTTP over SSL/TLS? No, the domain is not visible. The domain (hostname) you request is inside the encrypted communications between you and the remote server. O
by movedx 10y ago
HTTP over SSL/TLS? No, the domain is not visible.
The domain (hostname) you request is inside the encrypted communications between you and the remote server. Only the TCP information is visible (IP, source port, destination IP, and destination port.)
It's the DNS request which reveals the domain you requested.
- viraptor 10y agoHave a look at https communication in Wireshark for example. What you wrote is incorrect. Https reveals the domain at least one time these days. First, ssl extension SNI (https://en.m.wikipedia.org/wiki/Server_Name_Indication https://en.m.wikipedia.org/wiki/Server_Name_Indication) is sent, which reveals the domain you're requesting. This happens before the keys are exchanged. Then, the matching certificate is sent (again in plaintext) from the server so that you can verify it and extract the keys. It will contain the domain again, although it may be a partial one like *.example.com So no, the domain is public. The full URL path is encrypted though.
- movedx 10y agoThanks for the info! I hadn't considered some of those aspects of the connection process.