Can a Tor Exit Node Downgrade HTTPS to HTTP?

A Tor exit node can technically downgrade an unencrypted initial connection from HTTPS to HTTP through an attack known as SSL stripping. While an exit node cannot break standard, actively established TLS/SSL encryption, it can manipulate the initial, unencrypted handshake between the user and the destination server if proper modern security safeguards are not strictly enforced.

How an Exit Node Downgrades Connections

When you access a clearnet website through Tor, the exit node acts as the bridge between the encrypted Tor network and the open internet. The exit node decrypts your Tor traffic to send it to the final destination web server.

If you type a domain into the address bar without specifying the https:// protocol (e.g., example.com), your browser typically sends an initial request over unencrypted HTTP. The destination server normally replies with a redirect (such as an HTTP 301 or 302 status code) telling your browser to switch to HTTPS.

A malicious exit node can intercept this redirect in a technique known as SSL Stripping: 1. The exit node communicates securely with the destination server over HTTPS. 2. The exit node modifies the traffic sent back to you, replacing all HTTPS links with plain HTTP. 3. The connection between your browser and the exit node remains entirely in unencrypted HTTP.

Because the traffic between you and the exit node is downgraded to HTTP, the operator of that exit node can view all transmitted data in plain text, including login credentials, session cookies, and private messages.

Why Exit Nodes Cannot Break Existing HTTPS

If an HTTPS connection is already established, an exit node cannot silently downgrade or decrypt the traffic. Attempting a traditional Man-in-the-Middle (MitM) attack by generating a fake SSL/TLS certificate will trigger an explicit security warning in the user’s browser, alerting them that the connection is insecure and the certificate is invalid.

Built-in Defenses Against Downgrade Attacks

Modern browsers and internet standards have made SSL stripping attacks significantly harder to execute:

• HTTPS-Only Mode: The standard Tor Browser includes an HTTPS-Only mode enabled by default. This forces the browser to upgrade all connections to HTTPS before sending the request out, entirely preventing unencrypted HTTP fallbacks.
• HTTP Strict Transport Security (HSTS): Websites using HSTS instruct the browser to always use HTTPS, rejecting plain HTTP entirely. Browsers also maintain “HSTS Preload Lists,” ensuring that the browser connects securely even on the very first visit without needing a redirect.
• Onion Services (.onion): Websites hosted directly within the Tor network as Onion Services do not use exit nodes at all. The connection is end-to-end encrypted across the entire Tor circuit, eliminating exit node vulnerabilities completely.