The Complete SSL and TLS Guide: HTTP to HTTPS

Analyze research on SSL, TLS and HTTPS that shows rising adoption, with more than half of sites using HTTPS by 2018 and that secure setup does not guarantee full security.

Explore how Google and Instagram use https, inspect the lock icon, and learn about certificate validity, expiration, and fingerprints in the certificate chain from issuing authorities.

Compare http and https by inspecting a real site's network traffic, noting http is not secure and https uses encryption, ports 80 versus 443.

Explore the tcp/ip stack by example with wireshark, examining ethernet, IPv4, tcp, and tls headers, and tracing http and https traffic on port 443.

Observe how https traffic captured with Wireshark uses TLS 1.2, with HTTP over TLS and the TLS record layer encrypting all data with symmetric key encryption and RSA keys.

Explore encryption fundamentals, compare symmetric and asymmetric methods, and learn how RSA protocol works, public key infrastructure, and hashing algorithms like MD5 and SHA are used.

Explore encryption mechanisms, hash functions, and common algorithms, and introduce symmetric encryption where the same key encrypts and decrypts data. Emphasize key secrecy and non-transfer in symmetric encryption.

Hashes produce fixed-length, irreversible strings from input data to verify integrity, with md5 and sha algorithms discussed for ssl tls context, and changing a single bit yields a different hash.

Explore MD5, a fixed 128-bit one-way hash used for password storage, and learn how comparing two hashes proves data was not mutated.

Explore how asymmetric keys use a public key to encrypt data and a private key to decrypt, ensuring only the owner can read the message.

Learn how asymmetric keys sign data to ensure origin and integrity by hashing data, signing with private key, and verifying with public key in SSL certificates and RSA protocol.

Learn the public key infrastructure (PKI) that underpins https, including certificates and public keys. See how certificate authorities and intermediate CAs establish a chain of trust for encryption and authentication.

Explain what a certificate contains: owner, issuer, signature, and public key, and how it creates a chain of trust with certificate authorities, enabling RSA-based https encryption via PKI.

Learn to install OpenSSL to generate RSA keys and create a certificate signing request, with step-by-step guidance for Windows installers and notes that Mac users already have OpenSSL.

Generate RSA keys with OpenSSL and encrypt the private key with a passphrase using AES-256. Store the private key in private.pem and extract the public key to public.pem.

Explore the instagram.com certificate in practice, tracing the chain from root to intermediate to instagram.com's certificate, and examining the common name, key size, sha-256 signature, and DNS names.

Analyze comodo.com's certificate to understand the certificate chain with root and intermediate authorities, single-domain cert for comodo.com, extended validation details, and sha-256 with rsa signatures.

Understand what a root certificate authority is, why root certificates are self-signed, and how operating systems and browsers trust them via system roots, intermediate CAs, and the chain of trust.

Explore how the chain of trust forms from root CA to intermediate CAs to end user certificates using private keys, signatures, and CSR-based signing.

Learn about certificate domain scopes—single-domain, wildcard, and multi-domain—covering common name, wildcard patterns, and subject alternative names, plus how scope affects pricing, and get a preview of TLS/SSL secure connections.

Explore TLS details, from session setup and algorithms to the Keeper suite, encryption key generation, Diffie-Hellman and elliptic curve Diffie-Hellman exchanges, and elliptic curve cryptography.

Learn how ssl and tls provide encryption in https and how certificates establish browser-server trust, independent of the protocol; a certificate can be used with either ssl or tls.

Trace the history and versions of SSL and TLS, note that SSL is deprecated, and advise using TLS certificates, with TLS 1.2 and 1.3 enabled on web servers.

Explore how tls session establishment secures https by negotiating a cipher suite, exchanging and validating certificate chains, and generating a symmetric key via public key encryption or Diffie-Hellman.

Analyze TLS session setup in practice with Wireshark, from client hello and server hello to certificate exchange, Diffie-Hellman key exchange, and establishing the symmetric key for HTTPS data using http2.

Explore cipher suites in TLS, comparing key exchange methods like Diffie-Hellman and elliptic curve Diffie-Hellman, and the roles of ChaCha encryption protocol and SHA-256 hashing in secure sessions.

Explain how a browser obtains an encryption key without diffie-hellman by encrypting a random key with the server's public RSA key, using the certificate for authentication.

Explore how TLS uses Diffie-Hellman to deliver keys and create symmetric keys on both sides during a public exchange, with certificate verification and protection against man in the middle attacks.

Diffie-Hellman enables two parties to generate a shared key over an insecure connection without sending the key, using one-way functions, with standard mod operation and elliptic-curve variants for TLS.

Explain the modulus operation and its remainder concept with examples, show its one-way property, and connect how Diffie-Hellman uses modulus for secure key exchange.

Learn how the Diffie-Hellman key exchange uses modulus operations to generate a shared key over an insecure connection, leveraging private and public keys in a two-packet exchange.

Explore elliptic curve cryptography and how it powers TLS and Diffie-Hellman key exchange, using the curve equation y^2 = x^3 + a x + b and its symmetry about x-axis.

Explore elliptic curves, point addition and point multiplication on the curve, using line intersections to derive R from P and Q and doubling a point.

Explore elliptic-curve point addition by drawing lines through Q and R to obtain 2Q, 3Q, and 4Q, with reflections across the x-axis yielding S and L.

Learn how elliptic curve cryptography and diffie-hellman key exchange generate the same key on both sides, using g^a mod p and point addition on curves.

Set up a free hosting page on GitHub pages by creating a public repository named username.github.io, adding an index.html, and publishing to verify a valid TLS certificate.

Explore how a TLS session secures a GitHub.io site by examining a multi-domain certificate, its SANs, issuer chain, and the TLS handshake, including client hello and server hello.

Purchase a paid domain to go live with a production website. Then explore free hosting and free domain options for your first site.

Plan next steps by purchasing a custom domain, setting up hosting and certificates, and comparing free hosting with paid domain options and free certificates.

Set up free hosting, connect your domain to infinityfree, configure name servers, and test DNS resolution as you prepare to install a TLS certificate to secure your site.

Install a free tls certificate on free hosting via cPanel, address self-signed warnings, and learn to generate a key pair and obtain a valid certificate; note premium limits.

Explore a hands-on attempt to install a free Let's Encrypt TLS certificate on free hosting, covering automatic FTP verification, manual DNS verification, and why the effort fails.

Acquire a virtual private server with full shell access to host a WordPress site, then obtain a free TLS certificate via certbot from Letsencrypt, valid for 90 days.

Explore popular paid hosting providers—Amazon Web Services, Google Cloud, Microsoft Azure, and Digital Ocean—with a focus on Amazon EC2 pricing, free tiers, spot and reserved instances, and scalable configurations.

Explore pricing and hosting options across Google Cloud, Azure, and DigitalOcean, noting free tiers, VM configurations, and preemptible pricing.

Secure a WordPress site with a Let's Encrypt TLS certificate validated for the domain, and review its three-month renewal, OCSP status, and certificate chain.

Explore Let's Encrypt and certbot, a free TLS certificate service that automates domain validation and renewals via ACME, enabling secure traffic for websites.

Examine the certificate chain after issuance by inspecting live files on the server and decoding TLS certificates with online tools to verify chain integrity and protocol support.

Secure your domain on Digital Ocean with free TLS from Let's Encrypt via certbot and ACME, renewed every 90 days, and explore Cloudflare while analyzing TLS sessions with Wireshark.

We start using Cloudflare to learn how a reverse proxy works and how it provides free TLS encryption, even without a certificate on your servers.

Discover how Cloudflare acts as a reverse proxy to hide IP addresses and cache pages, saving bandwidth and reducing latency. Cloudflare offers free TLS certificates on a free plan.

Review the setup: a paid domain on Digital Ocean hosting WordPress on Ubuntu 18.04 with Let’s Encrypt TLS certificate served via https, and plan to move DNS to Cloudflare.

Set up a Cloudflare account, add your site, and import DNS records, then switch nameservers to route traffic through Cloudflare’s reverse proxy with the free plan, CDN, and SSL certificate.

Cloudflare provides a free, automatically issued, multi-domain TLS certificate for your site, valid for any subdomains of course.com, thanks to subject alternative names such as star.course.com and course.com.

Explore how Cloudflare manages edge and origin TLS certificates, explains universal SSL, age certificates, auto renewal, and the difference between flexible, full, and full strict modes.

Explore Cloudflare SSL operation modes, from flexible to full and full strict, and how using origin certificates or Cloudflare's origin certificates enables secure HTTPS connections.

Learn how to enable Cloudflare's flexible SSL mode, using an edge certificate while the origin has no TLS, and update DNS records to test secure access.

Create a new virtual private server, install Nginx, and configure a TLS certificate on Nginx, while using Cloudflare as an intermediate reverse proxy service.

Assess the setup: a single Digital Ocean droplet with WordPress, TLS, and Cloudflare in strict mode, and plan to install nginx on a new droplet with a Cloudflare origin certificate.

Create a droplet with Ubuntu 18.04, install nginx, and configure ufw firewall for HTTP, HTTPS, and SSH. Verify nginx works over HTTP and note HTTPS requires further TLS configuration.

Explain how Cloudflare handles ssl modes and origin certificates to enable https. Show Cloudflare's dns, analytics, caching, and page rules.

Disable Cloudflare by switching the domain’s name servers to DigitalOcean and updating A records to point to a new nginx droplet, then verify the direct SSL/TLS configuration.