Typorithm · hard

TLS Handshake

tls-handshakenetworkstlscertificatehandshake

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn TLS Handshake

L7 & TLS

TLS adds encryption, integrity, and server authentication on top of TCP. The handshake negotiates a cipher suite, exchanges keys (ECDHE for forward secrecy), and validates the certificate chain to a trusted CA. TLS 1.3 completes in one round trip; SNI carries the hostname.

TLS sits between TCP and the application, adding three guarantees: confidentiality (encryption), integrity (tamper detection), and authentication of the server. The handshake sets all of this up before any HTTP data flows.

The client's ClientHello offers cipher suites and a key share; the server's ServerHello picks a cipher and sends its certificate. ECDHE key exchange gives forward secrecy — a leaked long-term key cannot decrypt past sessions. The client validates the certificate chain up to a trusted CA and checks the hostname.

TLS 1.3 streamlines this to a single round trip and drops legacy ciphers. SNI (Server Name Indication) carries the requested hostname in the ClientHello so one IP can serve many certificates. Certificates carry notBefore/notAfter dates, which is why expired certs break connections.

TLS = encryption + integrity + server authentication over TCP.

Handshake negotiates a cipher and exchanges keys (ECDHE = forward secrecy).

TLS 1.3 needs one round trip; SNI carries the hostname.

openssl s_client -connect example.com:443
curl -v https://example.com
# ClientHello -> ServerHello -> cert -> keys
openssl x509 -in cert.pem -noout -dates
nmap --script ssl-enum-ciphers -p 443 host

Read the implementation

Connect each part of the code to the concept before you type.

1. Open a TLS session

openssl s_client opens a TLS connection to port 443 and prints the negotiated handshake details.

openssl s_client -connect example.com:443

2. Verbose HTTPS

curl -v shows the TLS handshake steps, including the cipher and certificate.

curl -v https://example.com

3. Handshake flow

The client and server exchange hellos, the server's certificate, then keys for the session.

# ClientHello -> ServerHello -> cert -> keys

4. Cert validity

x509 -dates prints a certificate's notBefore/notAfter validity window.

openssl x509 -in cert.pem -noout -dates

5. Enumerate ciphers

This nmap script lists which cipher suites a server supports on port 443.

nmap --script ssl-enum-ciphers -p 443 host

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.