Lesson 5.6: TLS in practice
TLS is where everything in this course meets: key exchange agrees on a secret, the certificate proves the server's identity, a signature ties them together, and an AEAD cipher protects the data. What happens in a TLS 1.3 handshake, why TLS 1.0 and 1.1 are retired, what a cipher suite is, and how to test a server with openssl s_client. In the lab you connect to the shop, find that it still accepts TLS 1.1, restrict nginx to TLS 1.2 and 1.3, test and reload, and prove that old clients are now refused while normal ones still connect.
17 min
You will learn to
- Explain the parts of a TLS connection
- Read openssl s_client output
- Explain why TLS 1.0 and 1.1 are retired
- Restrict protocol versions in nginx
- Verify a TLS configuration from the client side
Key terms
- TLS
- Transport Layer Security: the protocol that encrypts and authenticates connections such as HTTPS, secure e-mail and many VPNs.
- Handshake
- The start of a TLS connection: agree on a version and cipher, exchange keys, prove the server's identity with its certificate.
- Cipher suite
- The combination of algorithms used for a connection.
- Forward secrecy
- Using fresh, temporary keys for each session so that a later theft of the server's private key can't decrypt recorded past traffic.
- SNI
- Server Name Indication: the client says which host name it wants, so one IP can serve many certificates.
- Downgrade attack
- Tricking two parties into using a weaker protocol or cipher than both support.
← Cross-site request forgery (CSRF) · All lessons · Patching, backups and logging: the boring controls that save you →