> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/red-team/sniffing/tls-ssl.md).

# TLS/SSL

**TLS (Transport Layer Security)** and **SSL (Secure Sockets Layer)** are cryptographic protocols designed to provide secure communication over a network. TLS is the successor to SSL and is more secure.

They are used in:

* HTTPS (secure web traffic)
* SMTPS, IMAPS, POP3S (email)
* VPNs

***

### HTTP vs HTTPS Handshake

#### 1. HTTP Three-Way Handshake (TCP Layer)

Before TLS/SSL starts, a TCP connection is established via the three-way handshake:

1. **SYN**: Client sends SYN to server with initial sequence number.
2. **SYN-ACK**: Server responds with SYN-ACK and its own sequence number.
3. **ACK**: Client acknowledges and the connection is established.

***

#### 2. HTTPS (TLS/SSL) Handshake

**Step 1: Client Hello**

* Sent by client
* Includes supported cipher suites and random nonce

**Step 2: Server Hello + Certificate**

* Sent by server
* Includes chosen cipher suite, server nonce, and digital certificate

**Step 3: Key Exchange**

* Client verifies certificate
* Generates a pre-master secret
* Encrypts it with server’s public key
* Sends it to the server

**Step 4: Session Key Generation**

* Both client and server generate the same session key from:
  * Pre-master secret
  * Client and server nonces

**Step 5: Change Cipher Spec**

* Both sides confirm encryption with new session key
* Secure encrypted communication begins

***

### Certificate Authority (CA)

A **Certificate Authority** is a trusted entity that:

1. **Verifies** identity of certificate requesters
2. **Issues** digital certificates containing public keys
3. **Signs** certificates with its private key
4. **Distributes** and maintains certificate revocation lists

**Components in a Digital Certificate:**

* Subject (owner)
* Public key
* Validity period
* Issuer (CA)
* CA’s signature

#### Certificate Validation Process:

* Browser checks if CA is trusted
* Verifies certificate signature with CA’s public key
* Validates expiration and revocation