Recap: HTTPS

HTTPS is HTTP inside TLS, and TLS does two jobs.

It encrypts, so the path, headers and body stop being readable in transit. Over plain HTTP all of that is text on the wire, as you saw by reading a password back out of your own request.

It identifies, through a certificate checked three ways: signed by an authority in your machine's CA bundle, not expired, and issued for the host you actually asked for.

The scheme decides the default port, 80 or 443, and whether a handshake happens at all. A plain port asked for TLS fails immediately with exit code 35.

And -k silences certificate errors by giving up the identity check. Reach for it on a test box, never as a fix for something real.