Do all .onion addresses use SSL/TLS?

Question

Do .onion sites encrypt the information going through the exit node? Because a lot of them start with HTTP and not HTTPS.

score 17 · Answer 1 · answered Mar 17 '15 at 02:50

No, .onion sites are not using https/ssl by default. But the connection inside the Tor network is always encrypted, so it is not really necessary to use https for .onion sites. Exit nodes aren't used at all with hidden services, because the connection stays inside the Tor network until the hidden service is reached.

Alexey Vesnin · Answer 2 · 2016-01-29T19:01:20.310

2

Do not mess up using Tor as a transport layer, where encryption is used for your privacy protection primarily, and the HTTP access protection by using SSL(aka HTTPS ). Onion sites may use HTTPS freely by just routing in stunnel-fashion way all the ports they need to a full-featured webserver with HTTPS protection enabled.

edited Jan 29 '16 at 19:01

answered Jan 29 '16 at 17:05

Alexey Vesnin

6,385
3
15
36

score 0 · Answer 3 · answered May 05 '15 at 13:51

0

By default SSL is not used. But if you like to, you can get a cert and use it on top the tor encryption. Its a ongoing discussion, whether or not SSL should be used. Here are some facts and thoughts about it.

answered May 05 '15 at 13:51

wedel

124
11

Do all .onion addresses use SSL/TLS?

3 Answers3