HTTPS and TLS Explained: How Secure Connections Actually Work

// TLS 1.3 Handshake — annotated step by step
// Each arrow shows the direction of the message

Client                                          Server
  |
  |--- ClientHello -------------------------------->|
  |    [Supported TLS versions: 1.2, 1.3]          |
  |    [Supported cipher suites: AES-256-GCM, ...]  |
  |    [Client's DH key share]                      |
  |    [Random nonce: client_random]                |
  |                                                 |
  |<-- ServerHello ----------------------------------|
  |    [Chosen TLS version: 1.3]                    |
  |    [Chosen cipher: AES-256-GCM-SHA384]          |
  |    [Server's DH key share]                      |
  |    [Random nonce: server_random]                |
  |                                                 |
  |<-- Certificate ----------------------------------|
  |    [Server's public key]                        |
  |    [Signed by: DigiCert CA]                     |
  |    [Domain: example.com]                        |
  |    [Valid until: 2025-12-31]                    |
  |                                                 |
  |<-- CertificateVerify ----------------------------|
  |    [Proof server owns the private key]          |
  |                                                 |
  |<-- Finished (encrypted) ------------------------|
  |    [Handshake MAC — confirms nothing tampered]  |
  |                                                 |
  |--- Finished (encrypted) ------------------------>|
  |                                                 |
  // Both sides now independently computed:
  // shared_secret = DH(client_private, server_public)
  //               = DH(server_private, client_public)
  //
  // From shared_secret + client_random + server_random:
  // client_write_key, server_write_key are derived
  //
  // All application data from here is encrypted with AES-256-GCM
  |
  |=== Application Data (encrypted) =============>|
  |    GET /account HTTP/1.1                        |
  |    Host: example.com                           |
  |    Cookie: session=abc123                      |
  |                                                 |
  |<=== Application Data (encrypted) ==============|
  |    HTTP/1.1 200 OK                              |
  |    Content-Type: application/json              |

#!/bin/bash
# Inspect the TLS certificate of any live server from the command line.
# This is what your browser does automatically — we're just making it visible.

TARGET_DOMAIN="example.com"
TARGET_PORT="443"

echo "=== Fetching TLS certificate for ${TARGET_DOMAIN} ==="

# openssl s_client opens a raw TLS connection
# </dev/null feeds it an empty stdin so it doesn't hang waiting for input
# 2>/dev/null suppresses the verbose handshake noise
openssl s_client \
  -connect "${TARGET_DOMAIN}:${TARGET_PORT}" \
  -servername "${TARGET_DOMAIN}" \
  </dev/null 2>/dev/null \
  | openssl x509 -noout -text \
  | grep -A2 -E 'Issuer:|Subject:|Not Before|Not After|Subject Alternative'

echo ""
echo "=== Check if certificate is currently valid ==="

# This exits with code 0 if the cert is valid, non-zero if expired or untrusted
EXPIRY=$(openssl s_client \
  -connect "${TARGET_DOMAIN}:${TARGET_PORT}" \
  -servername "${TARGET_DOMAIN}" \
  </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate)

echo "Expiry: ${EXPIRY}"

# Parse the expiry date and check days remaining
EXPIRY_DATE=$(echo "${EXPIRY}" | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "${EXPIRY_DATE}" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "${EXPIRY_DATE}" +%s)
NOW_EPOCH=$(date +%s)
DAYS_REMAINING=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

if [ "${DAYS_REMAINING}" -lt 30 ]; then
  echo "WARNING: Certificate expires in ${DAYS_REMAINING} days — renew soon!"
else
  echo "Certificate is healthy: ${DAYS_REMAINING} days remaining."
fi

# Simplified Diffie-Hellman demonstration
# This uses toy numbers to show the CONCEPT.
# Real TLS 1.3 uses elliptic curve DH with 256-bit keys.

import random

def compute_public_value(generator, private_key, prime_modulus):
    """
    Each party computes: public_value = generator^private_key mod prime_modulus
    This is the 'one-way function' — easy to compute, hard to reverse.
    """
    return pow(generator, private_key, prime_modulus)

def compute_shared_secret(their_public_value, my_private_key, prime_modulus):
    """
    Each party computes: shared_secret = their_public^my_private mod prime_modulus
    The magic: both parties compute the SAME value without ever sharing private keys.
    """
    return pow(their_public_value, my_private_key, prime_modulus)

# --- Parameters agreed upon in public (sent in ClientHello/ServerHello) ---
# In real TLS these are standardized curves like X25519, not small integers
PRIME_MODULUS = 23   # A small prime for demonstration (real: 2^255 - 19 for X25519)
GENERATOR = 5        # A primitive root of the prime (publicly known)

print(f"Public parameters: prime={PRIME_MODULUS}, generator={GENERATOR}")
print(f"(These are sent openly in the TLS Hello messages)")
print()

# --- Browser (Client) side ---
browser_private_key = 6    # NEVER sent over the wire — kept secret forever
browser_public_value = compute_public_value(GENERATOR, browser_private_key, PRIME_MODULUS)
print(f"Browser private key (secret):  {browser_private_key}")
print(f"Browser public value (sent):   {browser_public_value}")  # Sent in ClientHello
print()

# --- Server side ---
server_private_key = 15    # NEVER sent over the wire — discarded after handshake in TLS 1.3
server_public_value = compute_public_value(GENERATOR, server_private_key, PRIME_MODULUS)
print(f"Server private key (secret):   {server_private_key}")
print(f"Server public value (sent):    {server_public_value}")   # Sent in ServerHello
print()

# --- Each side independently computes the SAME shared secret ---
# Browser computes: server_public ^ browser_private mod prime
browser_computed_secret = compute_shared_secret(server_public_value, browser_private_key, PRIME_MODULUS)

# Server computes: browser_public ^ server_private mod prime
server_computed_secret = compute_shared_secret(browser_public_value, server_private_key, PRIME_MODULUS)

print(f"Browser computed shared secret: {browser_computed_secret}")
print(f"Server computed shared secret:  {server_computed_secret}")
print(f"Do they match? {browser_computed_secret == server_computed_secret}")
print()

# --- Attacker's perspective (they saw everything sent over the wire) ---
# Attacker knows: prime=23, generator=5, browser_public=8, server_public=19
# To find browser_private, attacker must solve: 5^x mod 23 = 8
# This is the Discrete Logarithm Problem — infeasible with real 256-bit keys
print("Attacker knows publicly:")
print(f"  prime={PRIME_MODULUS}, generator={GENERATOR}")
print(f"  browser_public={browser_public_value}, server_public={server_public_value}")
print("Attacker cannot compute the shared secret without solving discrete log.")
print(f"In real TLS with X25519, this requires more compute than exists on Earth.")

# Production-grade Nginx TLS configuration
# Based on Mozilla Intermediate compatibility profile
# Supports: TLS 1.2 and TLS 1.3 (drops TLS 1.0 and 1.1 entirely)

server {
    listen 443 ssl;                        # Listen for HTTPS connections
    listen [::]:443 ssl;                   # IPv6 as well
    http2 on;                              # Enable HTTP/2 (requires TLS)
    server_name example.com www.example.com;

    # --- Certificate configuration ---
    # Let's Encrypt managed cert (Certbot updates these paths automatically)
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Diffie-Hellman parameters for TLS 1.2 key exchange
    # Generate with: openssl dhparam -out /etc/nginx/dhparam.pem 2048
    ssl_dhparam /etc/nginx/dhparam.pem;

    # --- TLS version enforcement ---
    # Drop TLS 1.0 and 1.1 entirely — both are deprecated and vulnerable
    ssl_protocols TLSv1.2 TLSv1.3;

    # --- Cipher suites (TLS 1.2 only — TLS 1.3 ciphers are non-negotiable) ---
    # Forward-secrecy enabled ciphers only, ordered by preference
    # CHACHA20 first for mobile clients without AES hardware acceleration
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;         # Let client pick in TLS 1.3

    # --- Session resumption (performance) ---
    # Allows clients to resume TLS sessions without a full handshake
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL_CACHE:10m; # 10MB cache, ~40k sessions
    ssl_session_tickets off;               # Off = better forward secrecy

    # --- OCSP Stapling ---
    # Server pre-fetches revocation status and bundles it with the handshake
    # Saves one round trip to the CA on every new connection
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    resolver 1.1.1.1 8.8.8.8 valid=300s;  # Where to resolve OCSP server address
    resolver_timeout 5s;

    # --- Security headers (applied to all responses) ---
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    # ^ 2-year HSTS. includeSubDomains covers *.example.com. preload submits to browser preload lists.

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Content-Security-Policy "upgrade-insecure-requests" always;
    # ^ Upgrades any accidental http:// resource loads to https:// — kills mixed content

    location / {
        proxy_pass http://localhost:3000;   # Your app runs internally on plain HTTP
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https; # Tell your app it's behind HTTPS
    }
}

# --- HTTP to HTTPS redirect (catches http:// requests) ---
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Permanent redirect — browser caches this after first visit
    return 301 https://$host$request_uri;
}