Https is the secure version of the http protocol for connecting to web-servers.
Websites that use the https (hyper text transfer protocol secure) protocol provide an encrypted connection between your device and the web-server hosting the page you have requested.
However, just because you type in https://amazon.co.uk in to your browser bar for example, does not necessarily mean you are connected to the real amazon.co.uk website.
This is because the address amazon.co.uk is converted to the IP address of the web-server hosting the page by a service known as the Domain Name System or DNS.
This works like a phone book, so you type in a web address you want to visit and your DNS looks up the number or IP address of the appropriate web-server and retrieves the web page from the appropriate web-server for you.
If the DNS has been compromised or hijacked in anyway, when you type in https://amazon.co.uk, you are sent to the IP address of a rogue website that appears to be and looks like the real amazon.co.uk site.
The connection to the rogue server is still using https and displays a padlock icon but the attacker will have access to your data.
You can ensure that you are on the correct web page by examining the servers Secure Socket Layer (SSL) Certificate the genuine version of which can only be displayed by the real amazon.co.uk web-server.
Follow these simple steps. The Firefox browser is used here, but all browsers will allow you to view the certificate of a connection using https:
Type amazon.co.uk in to your browers location bar
Your browser will connect to the web-server provided by the DNS and display a padlock icon. Notes in grey, Firefox has added https://www to the address you typed. Its in grey to clearly show what has been added.
Click on the padlock icon
Click ‘More Information’
Click ‘View Certificate’
The SSL certificate will open. Check that the web address against Common Name (CN) is the same as the address in the location bar in the browser. If it is, you are connected to the real amazon.co.uk website with a secure https connection and your data is safe.
If the Common Name (CN) displayed differs in any way to what is in the location bar on your browser, there is a problem and you should not trust the website.
NB – The Common Name (CN) entry on the certificate only needs to match the domain of the website you have visited.
For example:
https://www.amazon.co.uk/gp/prime/pipeline/landing/ref=nav_prime_try_btn
is fine, because the domain matches the Common Name (CN) in the certificate.
You may see messages like the ones below if the web address does not match the Common Name (CN) in the certificate
Other browsers may display the padlock icon in a different location:
