Listen to this Post
SSL/TLS certificates are crucial for securing online communications by encrypting data between a client (e.g., a web browser) and a server.
Step 1: Server Obtains an SSL/TLS Certificate
The website owner purchases an SSL/TLS certificate from a Certificate Authority (CA) like DigiCert, Let’s Encrypt, or GlobalSign.
The CA verifies the website’s identity (domain ownership, organization details).
Once verified, the CA issues the certificate containing:
- The website’s public key
- The certificate’s expiration date
- The CA’s digital signature
Step 2: Client Requests a Secure Connection (HTTPS)
A user enters a URL (e.g., `https://example.com`), and the browser requests a secure connection with the server.
The browser initiates a TLS handshake.
Step 3: Server Sends the SSL/TLS Certificate
The web server responds by sending its SSL/TLS certificate to the client.
The client (browser) checks if the certificate is:
- Valid (not expired)
- Issued by a trusted CA
- Matched to the domain name
Step 4: Client Verifies the Certificate
The browser checks the certificate against a list of trusted CAs stored in its system.
If the certificate is valid and trusted, the handshake continues.
If invalid, the browser shows a security warning.
Step 5: Key Exchange (Session Key Creation)
The client and server use Public Key Cryptography to establish a shared encryption key.
Methods used:
- RSA (older, widely used)
- Diffie-Hellman (DHE)
- Elliptic Curve Diffie-Hellman (ECDHE) for better security and performance
Step 6: Secure Data Transmission (Encrypted Communication)
Once the session key is established, both sides encrypt and decrypt data using Symmetric Encryption (e.g., AES, ChaCha20).
The encrypted connection ensures:
- Confidentiality (data is private)
- Integrity (data isn’t modified)
- Authentication (ensures communication with the correct server)
Step 7: Secure Session Maintained
The encrypted session continues as long as the user interacts with the website.
If the session expires or is interrupted, a new SSL/TLS handshake is performed.
Step 8: Session Ends
When the user leaves the website or closes the browser, the session key is discarded.
A new handshake is required for future secure connections.
You Should Know:
1. Generating SSL/TLS Certificates with OpenSSL
Generate a private key openssl genpkey -algorithm RSA -out private.key -aes256 Generate a Certificate Signing Request (CSR) openssl req -new -key private.key -out request.csr Self-sign a certificate (for testing) openssl x509 -req -days 365 -in request.csr -signkey private.key -out certificate.crt Verify a certificate openssl x509 -in certificate.crt -text -noout
2. Checking SSL/TLS Certificate Validity
Check certificate expiration openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates Check certificate issuer openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -issuer
3. Configuring HTTPS in Nginx/Apache
Nginx:
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /path/to/certificate.crt;
ssl_certificate_key /path/to/private.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
}
Apache:
<VirtualHost :443> SSLEngine on SSLCertificateFile /path/to/certificate.crt SSLCertificateKeyFile /path/to/private.key SSLProtocol TLSv1.2 TLSv1.3 </VirtualHost>
4. Testing SSL/TLS Security
Test SSL/TLS configuration using OpenSSL openssl s_client -connect example.com:443 -tls1_2 Test with SSL Labs (online tool) curl https://api.ssllabs.com/api/v3/analyze?host=example.com
5. Automating Certificates with Let’s Encrypt (Certbot)
Install Certbot sudo apt install certbot python3-certbot-nginx Obtain and install a certificate sudo certbot --nginx -d example.com Auto-renew certificates sudo certbot renew --dry-run
What Undercode Say
SSL/TLS is the backbone of secure internet communication. Misconfigurations can lead to vulnerabilities like Heartbleed (CVE-2014-0160) or POODLE (CVE-2014-3566). Always:
– Use TLS 1.2 or 1.3 (disable older versions).
– Prefer ECDHE over RSA for forward secrecy.
– Regularly rotate certificates before expiration.
– Harden ciphers with AES-GCM or ChaCha20-Poly1305.
– Monitor for revoked certificates (OCSP Stapling).
Expected Output:
A secure, encrypted connection ensuring confidentiality, integrity, and authentication between clients and servers.
Relevant URLs:
References:
Reported By: Harisha Warnakulasuriya – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
