HTTPS

What is HTTPS?

HTTPS (HyperText Transfer Protocol Secure) is the secure form of HTTP in which all web traffic between a client and a web server runs through a TLS (Transport Layer Security) connection, so the data is encrypted, protected against modification and comes from a verified server. HTTPS is therefore not a separate protocol: it is ordinary HTTP inside a TLS tunnel, by default on TCP port 443. Netscape introduced HTTPS in 1994; the IETF documented its use in RFC 2818 in 2000, and since 2022 RFC 9110 defines the https scheme.

In OT environments, HTTPS mainly secures device web interfaces, such as switches, PLCs, HMIs and historian servers, plus the APIs through which edge and cloud applications retrieve data.

🧠 How does HTTPS work?

An HTTPS connection goes through four steps:

1. Connection and TLS handshake - the client opens a TCP connection and starts a TLS handshake. Client and server agree on a protocol version and cipher suite and jointly derive session keys. In TLS 1.3 this takes a single round trip.
2. Server authentication - the server sends an X.509 certificate. The client checks that it is signed by a trusted certificate authority (CA), that it is still valid and that the name matches the requested host. By default only the server presents a certificate; with mutual TLS (mTLS) the client also proves its identity with a certificate.
3. Encryption - all HTTP requests and responses, including the URL path, headers, cookies and passwords, cross the wire encrypted.
4. Integrity check - every TLS record carries a cryptographic check, so any tampering in transit is detected immediately.

This is how HTTPS protects against eavesdropping (sniffing), spoofing and man-in-the-middle attacks. HTTPS does not protect everything: the host name is usually still visible in the SNI field of the handshake, and a malicious website can hold a valid certificate just as easily. The padlock says something about the connection, not about how trustworthy the site is.

🔍 What is the difference between HTTP and HTTPS?

HTTPS works with every HTTP version. HTTP/1.1 and HTTP/2 run over TLS on TCP; HTTP/3 (RFC 9114, 2022) uses QUIC over UDP, which has TLS 1.3 built in. Browsers only support HTTP/2 and HTTP/3 over an encrypted connection.

🏭 Where is HTTPS used in industrial networks?

• Device management - web interfaces of Industrial Ethernet switches, O, firewall management consoles and PLC web servers.
• Operation and visualisation - SCADA portals and HMI web clients that run in a browser.
• Data and reporting - Historian and MES dashboards, plus REST APIs for edge and cloud integrations.
• Maintenance - firmware and configuration updates through secured web portals.
• External access - vendor portals behind a VPN or jump server, or via a reverse proxy in the DMZ.

For process data itself, OT usually relies on its own protocols. OPC UA has its own security layer (with an optional HTTPS transport), and MQTT runs over TLS on port 8883. HTTPS is mostly the channel for people and web applications.

⚠️ What problems does HTTPS face in OT environments?

Web interfaces on field equipment are a common point of attack. Typical bottlenecks:

• Self-signed certificates - many devices generate their own certificate on first boot. Browsers then show a warning, and operators learn to click it away. That very habit makes a man-in-the-middle attack much easier.
• Outdated TLS versions - older devices sometimes only support TLS 1.0 or 1.1, which were formally deprecated in 2021 (RFC 8996). Modern browsers refuse those connections.
• Expired certificates - an expired certificate can suddenly block an HMI web client or API integration, directly affecting availability.
• Wrong clock - certificate validation compares the validity dates with the system time. Devices without a reliable time source via NTP reject valid certificates or accept expired ones.
• HTTP left open - port 80 is often still enabled next to 443, so passwords can still travel unencrypted.

🔐 How do you set up HTTPS securely?

1. Inventory every device with a web interface, its TLS version and its certificate details.
2. Choose a TLS profile - TLS 1.3 where possible, TLS 1.2 with strong cipher suites where necessary. The TLS guidelines of the Dutch NCSC (version 2025-05) rate TLS 1.3 as “good” and TLS 1.2 as “sufficient”.
3. Replace self-signed certificates with certificates from your own OT CA and set up certificate management, with automated renewal (for example via ACME, RFC 8555) where devices support it.
4. Disable HTTP or use it only for redirects, and enable HSTS (RFC 6797) on web servers that support it.
5. Restrict who can reach the interface with network segmentation, firewall rules and access control, and combine remote login with MFA.
6. Harden and patch - remove default accounts, switch off unused web services (hardening) and include web server vulnerabilities in patch management.

Certificate pinning is no longer available in browsers (HPKP was removed from Chrome in 2019 and from Firefox in early 2020), but it remains useful in custom clients and apps that talk to one fixed server.

Mind the shorter lifetime of publicly trusted certificates. CA/Browser Forum ballot SC-081v3 (adopted on 11 April 2025) reduces the maximum validity from 398 to 200 days from 15 March 2026, to 100 days from 15 March 2027 and to 47 days from 15 March 2029. This applies to public certificates, such as those of cloud and vendor portals. An internal OT CA is not bound by it, but automation makes renewal manageable there too.

⚖️ Is HTTPS mandatory?

For Dutch public authorities it is: the Decree on secure connections with government websites and web applications, based on the Dutch Digital Government Act (Wet digitale overheid), has required HTTPS and HSTS (with an HSTS duration of at least one year) for publicly accessible websites and web applications since 1 July 2023. Internal sites that are not reachable from the internet are out of scope.

Standards and laws for businesses rarely name HTTPS explicitly, but they do require encryption and integrity protection of communication. Examples are IEC 62443 (requirements for confidentiality, communication integrity and the use of cryptography), ISO 27001 (control on cryptography), NIS2 with the Dutch Cybersecurity Act, and the Cyber Resilience Act, which requires products with digital elements to protect data with state-of-the-art encryption. In practice, HTTPS is therefore the expected compliance baseline for every web interface.

❓ Frequently asked questions

Which port does HTTPS use?

HTTPS uses TCP port 443 by default, while plain HTTP uses port 80. With HTTP/3, HTTPS runs over QUIC on UDP port 443. Devices and applications may use another port, such as 8443, but that does not change the security.

Is a website with HTTPS always trustworthy?

No, HTTPS only guarantees that the connection is encrypted and that the server holds the certificate for that domain name. Phishing sites also often use HTTPS with a valid certificate. Always check the domain name and do not rely on the padlock alone.

What is the difference between HTTPS and TLS?

TLS is the security protocol that encrypts and authenticates a connection, while HTTPS is HTTP running over such a TLS connection. TLS also secures other protocols, such as MQTT, email and OPC UA transports. HTTPS is therefore one application of TLS.

Can I use self-signed certificates on OT devices?

A self-signed certificate does encrypt the connection, but the browser cannot verify the identity of the device. Users then get used to clicking away warnings, which makes man-in-the-middle attacks easier. A better option is a certificate from your own OT certificate authority that is trusted on the engineering and management workstations.

Is HTTPS enough to secure a PLC web interface?

No, HTTPS only protects the transport, not the web application itself. A PLC web interface also needs strong passwords, role-based access, current firmware and network segmentation. Disable the PLC web server if you do not use it.

What is HSTS?

HSTS (HTTP Strict Transport Security, RFC 6797) is a header with which a web server tells the browser to access the domain only via HTTPS from then on. This prevents an attacker from downgrading the connection to unencrypted HTTP. Dutch government websites have been required to use HSTS since 1 July 2023.

📌 In summary

HTTPS is HTTP inside a TLS connection: it encrypts web traffic, verifies the identity of the server and detects tampering. In OT, HTTPS is the standard for the web interfaces and APIs of switches, PLCs, HMIs and historians, provided you use TLS 1.2 or 1.3, replace self-signed certificates with a managed internal PKI, disable HTTP and restrict access with segmentation and MFA.