使用 HTTPS 协议时，谁对消息进行加密，是浏览器还是网卡？
我正在阅读有关 WCF 传输安全性的内容，但我心中有很多疑问，因为我的网络知识较少。
他们说，只有当客户端和服务器之间存在直接通信时，传输安全才适合使用。不应该有中间人。
首先我想知道，这些中介机构是什么？根据我的说法，它们是位于两者之间的路由器，将消息中继到下一跳，并且不是完整的计算机系统，有人可以坐在上面拦截消息。
我对这个话题还有其他疑问，一旦收到这个问题的答案我就会问。
I am reading about WCF Transport Security and I get a plethora of doubts in my mind because I have less network knowledge.
They say, Transport security is good to use only when there is direct communication between client and server. There should be no intermediaries.
First of all I want to know, what are these intermediaries ? According to me, they are the routers sitting in between, which relay the messages to next hop, and are not complete computer systems, on which somebody can sit and intercept the messages.
I have other doubts also regarding this topic, which I will ask once I receive the answer for this one.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在这种情况下，没有路由器不是中介。路由器、交换机和其他网络基础设施设备在 ISO/OSI 或 TCP/IP 网络协议栈的较低层上运行。
在这种情况下，中介是网关、负载均衡器或反向代理。从客户端的角度来看，网关或反向代理是服务的主机，但不一定是。它可以只是某个公司网络的入口点，它将消息转发到隐藏在公司网络内的真实主机（托管服务的服务器）。
消息安全性和传输安全性之间的区别在于，传输安全性在网关处结束 - 对于客户端来说，它是目的地，并且客户端打开到该目的地的连接。连接是点对点的，无法在多个连接之间维护传输安全（传输安全从连接的一侧开始并在另一侧结束）。消息安全性又是端到端的，这意味着消息包含安全性作为其内容的一部分，并且网关仅转发安全消息。只有真正的目的地（服务的真实主机）才应该能够解密这些消息。
同样，HTTPS 是上层协议 - 网卡不负责使用它。某些编程 API 或操作系统基础设施负责创建 HTTPS 连接。浏览器只需调用这个API即可。
No routers are not intermediaries in this scenario. Routers, switches and other network infrastructure devices operates on lower layers of ISO/OSI or TCP/IP network protocol stacks.
Intermediaries are in this case gateways, load balancers or reverse proxies. From the client point of view the gateway or reverse proxy is the host of the service but it doesn't have to be. It can be just entry point into some corporate network which will forward the message to the real host (server hosting the service) hidden inside the corporate network.
The difference between message and transport security is that transport security ends at the gateway - for client it is a destination and client opens connection to that destination. The connection is point to point and transport security cannot be maintained among multiple connections (transport security starts at one side of the connection and ends on the other side). Message security in turn is end to end it means that message contains security as part of its content and gateways just forward secured messages. Only the real destination (real host of the service) should be able to decrypt those messages.
Again HTTPS is upper layer protocol - it is not responsibility of the network card to use it. Some programming API or OS infrastructure is responsible for creating HTTPS connection. Browser just calls this API.