TLS Fundamentals
TLS is a network security protocol that protects data moving between a client and server. It establishes shared keys, authenticates peers, and detects changes to data in transit.
itNetworking | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
TLS Fundamentals
Transport Layer Security, or TLS, protects a connection across an untrusted network. An application protocol such as HTTP runs above it. TCP usually carries it, while QUIC uses the TLS 1.3 handshake with QUIC's own protected packet layer.
TLS gives a connection three main properties:
- Confidentiality: an observer cannot read protected application data without the traffic keys.
- Integrity: a peer detects protected data changed in transit.
- Authentication: a peer can prove an identity with credentials and cryptographic signatures.
These properties answer different questions. Encryption hides bytes. Integrity detects modification. Authentication tells you who controls the key used by the peer. A connection can be strongly encrypted to the wrong server if identity verification is missing.
The two working parts
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.rfc-editor.org/rfc/rfc9846.html
Supports
- TLS 1.3 handshake flow, key schedule, authentication, Finished messages, and record protection
- TLS 1.3 cipher suites select authenticated encryption and a hash while key exchange and signatures are negotiated separately
- Session resumption uses pre-shared keys and can combine them with fresh key shares
- Zero round trip time early data has replay risk
- Mutual TLS certificate authentication and private-key proof
- TLS protects a connection between its endpoints
- https://www.rfc-editor.org/rfc/rfc9325.html
Supports
- Secure deployment guidance prefers TLS 1.3 and forbids SSL 2, SSL 3, TLS 1.0, and TLS 1.1
- TLS 1.2 remains a compatibility option when configured according to current guidance
- Resumption ticket protection, rotation, and forward-secrecy guidance
- SNI and ALPN deployment guidance
- Strict TLS and HSTS reduce plaintext downgrade exposure
- https://www.rfc-editor.org/rfc/rfc5280.html
Supports
- X.509 certificate and certificate revocation list profile
- Trust anchors, certificate extensions, constraints, validity, and certification-path validation
- https://www.rfc-editor.org/rfc/rfc9525.html
Supports
- TLS service-identity construction and verification
- Subject Alternative Name identifiers replace Common Name for service identity
- DNS, IP, service, and URI identifier matching
- Clients should terminate when no presented identifier matches a reference identifier
- https://www.rfc-editor.org/rfc/rfc6066.html
Supports
- Server Name Indication carries a DNS hostname in ClientHello
- SNI supports certificate and policy selection for virtual services on one network address
- https://www.rfc-editor.org/rfc/rfc7301.html
Supports
- ALPN lets peers select an application protocol during the TLS handshake
- https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Transport_Layer_Security
Supports
- TLS provides confidentiality, integrity, and authentication across an untrusted network
- HTTPS uses TLS to protect HTTP
- The web TLS handshake negotiates protocol parameters and authenticates servers
- HSTS helps resist downgrade to unprotected HTTP
- https://github.com/sindresorhus/awesome
Supports
- Discovery index for curated security and networking awesome lists
- https://github.com/sbilly/awesome-security
Supports
- Security ecosystem list discovered from the main Awesome index
- https://github.com/decalage2/awesome-security-hardening
Supports
- TLS and SSL section lists Qualys SSL Labs, CryptoLyzer, SSLyze, and testssl.sh
- TLS configuration section lists the Mozilla SSL Configuration Generator
- https://www.ssllabs.com/
Supports
- SSL Labs provides hosted server certificate and TLS configuration testing
- https://nabla-c0d3.github.io/sslyze/documentation/
Supports
- SSLyze provides command-line and Python-driven TLS server scans
- Scan commands cover certificate, cipher-suite, resumption, and vulnerability checks
- https://testssl.sh/
Supports
- testssl.sh checks TLS protocols, cipher support, and cryptographic flaws on TLS and STARTTLS services
- The tool runs locally and supports machine-readable output
- https://mozilla.github.io/server-side-tls/ssl-config-generator/
Supports
- TLSRef generates sample TLS configurations by server software and compatibility profile