Security · intermediate

TLS and HTTPS

TLS establishes an integrity-protected, encrypted channel and can authenticate one or both peers. In ordinary HTTPS, the client authenticates the server name through certificate validation or another configured trust mechanism; client authentication is optional and application-dependent.

Why it matters

TLS errors distinguish untrusted identity, hostname mismatch, expired credentials, protocol incompatibility, and interception from ordinary HTTP failures. Secure defaults depend on validating identity, not encryption alone.

Mental model

How to reason about tls and https

Before protected application data flows, peers negotiate cryptographic parameters and prove key possession; the client validates the server's certificate chain and intended hostname. Session keys then protect records in transit, while HTTP remains the application protocol inside that channel.

Analogy

TLS is a tamper-evident private courier who also checks the recipient's credential. A sealed envelope without a verified recipient can hide content while still delivering it to an impostor.

Examples

See the boundary, not just the happy path

Worked example · Inspect curl's TLS negotiation

curl -v https://example.com/ -o /dev/null

Verbose output can reveal the connection address, negotiated TLS details, certificate subject information, and HTTP exchange. It may expose request metadata, so use it carefully around secrets.

Worked example · Inspect a named TLS service

openssl s_client -connect example.com:443 -servername example.com </dev/null

-servername sends the intended server name for virtual hosting. The output exposes the presented chain and handshake details; verification behavior depends on OpenSSL options and version, so inspect the verify result rather than assuming presentation means trust.

Useful contrast · Encryption without trusted identity

curl -k https://untrusted.example/

-k disables normal certificate verification. Traffic can still be encrypted to whoever answered, but the client has abandoned the proof that it reached the intended server, enabling active interception.

Common mistakes

Misconceptions to remove early

Using insecure verification bypasses as a permanent fix

Options such as curl -k suppress the identity check that prevents man-in-the-middle attacks. Fix the name, certificate chain, trust store, or clock instead.

Assuming HTTPS hides all connection metadata

TLS protects HTTP content in transit, but endpoints still need routing information such as IP addresses. DNS and the TLS server name can also remain observable unless separately protected by applicable mechanisms.

Quick check

Can you predict the result?

1. What security property is lost when curl uses -k?
  • Normal verification that the certificate identifies a trusted server for the requested name.
  • All encryption algorithms are disabled.
  • HTTP response status codes are ignored.
Answer: Normal verification that the certificate identifies a trusted server for the requested name.
2. Why must a client validate the requested hostname as well as a certificate signature?
Answer: A correctly signed certificate for a different name does not authenticate the intended server.

Keep building

Authoritative references

Make the idea retrievable.

Study this concept with spaced repetition, next to the commands where you use it.

Get Terminaster