SSL/TLS Operations

Explore how ssl communication works, from certificate authorities and root certificates to the seven-step handshake that establishes trust between client and server.

Compare CA-signed and self-signed certificates, noting trust, cost, and use for public sites versus closed networks, and explore private CAs for internal SSL management.

Read a website certificate as proof of identity using browser checks and OpenSSL. Decode it to view internals such as version, serial number, issuer, subject, and validity.

Analyze the ssl certificate structure, focusing on the data and signature sections, CA signing, and key concepts like version, serial number, subject, public key, san, ocsp, and crl.

Explore how a digital signature signs a file’s hash with a private key, enabling integrity, authenticity, and non-repudiation, then verify with the sender’s public key and ssl certificate applications.

Explore X.509 certificate standards within PKI, including DER binary encoding and PEM ASCII encoding, and learn extensions like .der, .cer, .crt, and .pem while OpenSSL converts formats without changing content.

Explain the SSL certificate types: domain validated, organization validated, and extended validated. Domain validated certificates are fastest and cheapest; organization validated reveals the organization name, and extended validated undergoes checks.

Explore symmetric and asymmetric encryption, hashing, and key lengths, guided by Kerckhoffs's principle, to understand how elliptic curve cryptography strengthens security and how quantum computing may change cryptography.

explains symmetric or private key encryption, where a single shared secret key encrypts and decrypts messages, and notes key exchange, speed advantages, and 128-bit and 256-bit security.

Explore the advanced encryption standard, a secure symmetric key cipher based on Rijndael, endorsed by NIST for government communications since 2001, and learn modes like ecb, cbc, ctr, and gcm.

Master the backbone of SSL by exploring public key infrastructure, asymmetric key encryption, confidentiality, authentication, and RSA, DSA, and elliptic curves.

Learn how rsa uses public keys n and e for encryption and signing, with decryption key d, and why factoring n is hard, making ssl tls key exchange slower.

Explore elliptic curve cryptography (ECC), the elliptic curve discrete logarithm problem, and why SEC provides fast, low-power public key operations for mobile devices with standard curves identified by nest.

Explore hashing algorithms as one-way functions that produce fixed-size outputs; note MD5 and SHA-1 vulnerabilities, and how SHA-256 (SHA-2) offers stronger, collision-resistant security for SSL/TLS.

Explore how SSL/TLS secures client–server communication through authentication, key exchange, and encrypted data transfer, using public-key and symmetric algorithms within the handshake and record protocols.

Explore the authentication stage of ssl/tls operations, showing client and server hello messages, version and cipher negotiation, certificate exchange, and verification against the CA trust store.

This lecture covers stage two key exchange in ssl/tls, where client and server derive the symmetric key and cipher specs through rsa or diffie-hellman.

Diffie-Hellman enables client and server to derive a shared master secret without sending the pre-master secret, exchanging intermediate keys in plaintext, with ephemeral keys delivering perfect forward secrecy.

Learn how the SSL/TLS record protocol performs encrypted data transfer, using the shared master secret, MAC then encrypt, compression of fragments, and a header that encodes record type and version.

Follow how the SSL/TLS handshake uses client and server public/private keys, random numbers, and the pre master secret to derive the master key for the record protocol.

Demo shows a tls handshake using openssl s_client to Qualcomm, outputting certificate chain, pem server cert, and a session summary including tls version, cipher, cn, issuer, and verification zero.

Create a private key and CSR with OpenSSL, then have a CA sign the CSR and install the certificate for HTTPS. Consider self-signed certificates for internal use, and their limitations.

Create your CSR with RSA 2048-bit or stronger and SHA-2 signing by a CA; protect private keys on devices and rotate them when staff leave to protect data in transit.

Discover how to deploy SSL certificates and private keys, terminate at the load balancer or on web servers, and configure apps like Apache and Nginx to use them.

Install certificates with secure configurations on load balancers or web servers, enable OpenSSL, avoid arc4 and legacy protocols, and use TLS 1.2 with aes-gcm, disabling export, null, and 3des ciphers.

Explore certificate revocation and why owners revoke certificates, including key compromise, CA compromise, and cessation of operation. Learn two methods—certificate revocation lists and OCSP—for checking revocation status by serial number.

Examine common ssl errors, including no certificate, wrong certificate, unsupported version, bad cert domain, unknown cipher suite, and revoked cert, with CRL or OCSP revocation checks and a badssl demo.

Explore OpenSSL CLI for SSL certificates and connections, including client -connect, showcerts, X509 decoding, CSR and key generation, and local server testing.

Explore the certificate trust system from the trust anchor to intermediate CA and the chain of trust that signs the leaf certificate for a website.

Verify the chain of trust from leaf certificate to root during the handshake using the browser's trust store and intermediate certificates.

Explore trust stores and cert stores as repositories of CA certificates trusted by applications and browsers; learn how to add or remove certificates and distinguish trust stores from keystores.

Explore trust store management across browsers and Java apps, including importing, listing, and removing certificates, and learn to use keytool with Tomcat and Fusion stores, set passwords, and assign aliases.

Trace the ssl journey from v2 to tls 1.3, noting tls 1.2’s dominance and the move toward security-focused cipher suites. Examine tls 1.3’s redesign for faster, more secure handshakes.

Explore TLS 1.3 and its safety and speed benefits, including removal of unsafe ciphers and faster handshakes with one RTT and zero RTT resumption.

Tls 1.3 enhances safety by removing static rsa key exchange, weak hashes, compression, renegotiation, non-aead ciphers, and export grade options, while enforcing ephemeral diffie-hellman and stronger ciphers.

Tls 1.3 strengthens safety with ecdc based curves and psa for key exchange, encrypted handshake and sni, and component-level cipher suite negotiation with ed25519 and ed448 signatures.

Explore how TLS 1.3 achieves one round-trip time for fresh connections, with fast handshakes, key exchange, certificate decryption, and optional client authentication, plus a session ticket for resumption.

Learn how TLS 1.3 uses zero RTT with session tickets and a resumption key to start application data after a prior handshake, with PSK as an alternate.

Deploy tls 1.3 on nginx and apache, note browser support, and assess firewall challenges with encrypted traffic after the hello, plus resumption and zero rtt caveats.