[ SRE_ARENA ]
← BACK TO ROADMAP
SSL/TLS & PKI DEEP DIVE

The Chain of Trust is Only as Strong as the Weakest Link.

Visualization: 1. The TLS 1.2 Handshake (Under the Hood)
DOWNLOADING CONCEPT: 1. THE TLS 1.2 HANDSHAKE (UNDER THE HOOD)...

↳TLS uses Asymmetric Cryptography (slow, public/private keys) to safely exchange a secret, and then uses Symmetric Cryptography (fast, shared key) for the actual data transfer.

The Verification Flow
  • ↳1. ClientHello: Client sends supported cipher suites and a random byte string.
  • ↳2. ServerHello: Server picks a cipher, sends its own random bytes, and sends its Digital Certificate (containing its Public Key).
  • ↳3. Authentication: The Client verifies the certificate against its local trust store (Root CAs).
  • ↳If valid, it generates a Pre-Master Secret.
  • ↳4. Key Exchange: The Client encrypts this Pre-Master Secret using the Server's Public Key.
  • ↳5. Server Decrypts: Only the Server has the Private Key to decrypt it.
  • ↳6. Symmetric Keys: Both sides now use the random bytes and the Pre-Master Secret to independently calculate the exact same Symmetric Session Key (e.g., AES-GCM).
  • ↳All further traffic is encrypted with this fast symmetric key.
▲ LIVE INCIDENTA script using curl is failing, but the website works fine in Chrome.
sre@arena:~/ssl-tls-pki
sre@arena:~$ openssl s_client -connect api.example.com:443 -showcerts