Realm Notes

Appearance

TLS / HTTPS ​

HTTPS = HTTP + TLS. Data is encrypted in transit instead of being sent as plain text.

What Is TLS? ​

Transport Layer Security — a cryptographic protocol that sits between TCP and HTTP.

  • Confidentiality — data is encrypted.
  • Integrity — data can't be tampered with.
  • Authentication — you're talking to the real server.

TLS Handshake ​

Client                                          Server
  |                                                |
  |------- ClientHello -------------------------->|  (TLS version, cipher suites, random)
  |                                                |
  |<------ ServerHello -----------------------------|  (chosen cipher, server random)
  |<------ Certificate -----------------------------|  (server's public key + identity)
  |<------ ServerHelloDone -------------------------|
  |                                                |
  |------- ClientKeyExchange ---------------------->|  (pre-master secret, encrypted with server's pub key)
  |------- ChangeCipherSpec ------------------------>|
  |------- Finished --------------------------------->|
  |                                                |
  |<------ ChangeCipherSpec --------------------------|
  |<------ Finished -----------------------------------|
  |                                                |
  |------ Encrypted Data ---------------------------->|

Both sides derive the session key from: client random + server random + pre-master secret.

TLS 1.3 simplified this — 1-RTT handshake, no RSA key exchange, only forward-secret modes.

Certificate & PKI ​

  • Server sends an X.509 certificate signed by a CA (Certificate Authority).
  • Browser checks: Is this CA trusted? Is the cert expired? Does the domain match?
  • This prevents MITM attacks.

Symmetric vs Asymmetric in TLS ​

PhaseTypeWhy
HandshakeAsymmetric (RSA/ECDH)Securely exchange keys
Data transferSymmetric (AES)Fast encryption

Key Terms ​

  • Cipher suite — e.g. TLS_AES_128_GCM_SHA256 (key exchange + encryption + hash).
  • Forward secrecy — even if private key is leaked later, past sessions can't be decrypted (ECDHE does this).
  • SNI (Server Name Indication) — lets one IP host multiple TLS certs.
  • HSTS — tells browser to always use HTTPS for a domain.