Unit 5: HTTPS and certificates · Lesson 1 of 5 · 18 min

What TLS adds

The same HTTP, inside a tunnel that hides it and proves who is on the other end.

mission

You are
The analyst reviewing the shop's HTTPS site.
Situation
The shop also runs on https://shop.internal:8443. Your lead asks what protection that actually adds and which protocol it uses.
Goal
Open a TLS connection by hand and read what was negotiated.
Hand in
The protocol version, cipher and certificate name the server presents.

TLS as an armoured tube

01

Shake hands

openssl s_client does only the TLS part and stops. -brief prints a short summary.

learner@web-lab
openssl s_client -connect shop.internal:8443 -brief </dev/null 2>&1 | grep -E '^(verify error|Protocol|Ciphersuite|Peer certificate)'
verify error:num=20:unable to get local issuer certificate
verify error:num=21:unable to verify the first certificate
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Peer certificate: C = GB, O = Example Shop, CN = shop.internal

you should see A protocol version, a cipher suite and the certificate's name. The verify errors appear because openssl, like curl, does not know the internal authority yet.

02

The same request, inside TLS

learner@web-lab
curl -s --cacert certs/shop-ca.crt https://shop.internal:8443/health
ok

you should see ok, exactly as over HTTP. TLS changes the road, not the conversation.

03

See the handshake from curl

learner@web-lab
curl -sv --cacert certs/shop-ca.crt https://shop.internal:8443/health 2>&1 | grep -E 'SSL connection|subject:|issuer:|verify ok'
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / RSASSA-PSS
*  subject: C=GB; O=Example Shop; CN=shop.internal
*  issuer: C=GB; O=Example Shop; CN=Example Shop Internal CA
*  SSL certificate verify ok.

you should see The negotiated suite, then who the certificate is for and who signed it.

What HTTPS wraps around a request

Data only
GET /health HTTP/1.1

Each step wraps the data in one more header, the way a sender builds a packet.

What a defender takes away

  1. 1TLS adds secrecy, integrity and proof of the server's identity.
  2. 2openssl s_client shows what a server negotiates without any HTTP.
  3. 3The HTTP inside a TLS connection is exactly the same as without it.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.