Unit 5: HTTPS and certificates · Lesson 1 of 5 · 18 min

What TLS adds

The same HTTP, inside a tunnel that hides it and proves who is on the other end.

mission

You are
The analyst reviewing the shop's HTTPS site.
Situation
The shop also runs on https://shop.internal:8443. Your lead asks what protection that actually adds and which protocol it uses.
Goal
Open a TLS connection by hand and read what was negotiated.
Hand in
The protocol version, cipher and certificate name the server presents.

TLS as an armoured tube

01

Shake hands

openssl s_client does only the TLS part and stops. -brief prints a short summary.

learner@web-lab
openssl s_client -connect shop.internal:8443 -brief </dev/null 2>&1 | grep -E '^(verify error|Protocol|Ciphersuite|Peer certificate)'
verify error:num=20:unable to get local issuer certificate
verify error:num=21:unable to verify the first certificate
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Peer certificate: C = GB, O = Example Shop, CN = shop.internal

you should see A protocol version, a cipher suite and the certificate's name. The verify errors appear because openssl, like curl, does not know the internal authority yet.

openssl
A toolkit for keys, certificates, hashes and encryption. Built into most Linux systems and macOS. Install with sudo apt install openssl, or brew install openssl on a Mac.
grep
Prints the lines of text that match a pattern. Built into Linux and macOS.
02

The same request, inside TLS

learner@web-lab
curl -s --cacert certs/shop-ca.crt https://shop.internal:8443/health
ok

you should see ok, exactly as over HTTP. TLS changes the road, not the conversation.

curl
Sends web requests and prints the response. Built into Linux, macOS and Windows 10 and later.
03

See the handshake from curl

learner@web-lab
curl -sv --cacert certs/shop-ca.crt https://shop.internal:8443/health 2>&1 | grep -E 'SSL connection|subject:|issuer:|verify ok'
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / RSASSA-PSS
*  subject: C=GB; O=Example Shop; CN=shop.internal
*  issuer: C=GB; O=Example Shop; CN=Example Shop Internal CA
*  SSL certificate verify ok.

you should see The negotiated suite, then who the certificate is for and who signed it.

What HTTPS wraps around a request

Data only
GET /health HTTP/1.1

Each step wraps the data in one more header, the way a sender builds a packet.

What a defender takes away

  1. 1TLS adds secrecy, integrity and proof of the server's identity.
  2. 2openssl s_client shows what a server negotiates without any HTTP.
  3. 3The HTTP inside a TLS connection is exactly the same as without it.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.