CodeParkHTTPS is HTTP sent inside a TLS connection. TLS (Transport Layer Security) gives three things:
- confidentiality: no one else can read the data
- integrity: no one can change the data without being detected
- server authentication: the client knows it talks to the real server
The TLS 1.3 handshake, step by step:
1. The client sends a ClientHello. It holds the supported cipher suites, a random value, and a key share. The key share is for an ephemeral Diffie-Hellman exchange. Ephemeral means the keys are new for each connection.
2. The server picks the parameters. It replies with a ServerHello and its own key share.
3. Now both sides can calculate the same secret. The rest of the handshake is encrypted.
4. The server sends its certificate. Then it sends a CertificateVerify signature. This proves it holds the private key. Then it sends Finished.
5. The client checks the certificate. It must chain to a trusted CA (certificate authority), still be valid, and match the hostname. Then the client sends its own Finished.
After that, application data flows encrypted with fast symmetric ciphers like AES-GCM. The key exchange is ephemeral, so it gives forward secrecy. This means a stolen server key later cannot decrypt old recorded traffic.
- TLS provides confidentiality, integrity and server authentication.
- ClientHello and ServerHello exchange ephemeral key shares.
- The server proves its identity with a certificate and a signature.
- The client checks the certificate chain, its expiry and the hostname.
- Data uses symmetric encryption, and ephemeral keys give forward secrecy.