HTTPS and TLS
How the web protects itself: what TLS guarantees, certificates and the chain of trust, the handshake, and the common problems (expired certificate, wrong name, mixed content, HSTS).
- 41 cards
- 3 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- The principles
- Certificates
- Common problems
A few cards from the deck
TLS: what is it?
Show the answer
The protocol that encrypts a connection and proves the server's identity
It sits between TCP and the application: HTTP, email or other protocols can run inside it.
What are TLS's three guarantees?
- Speed, compression and anonymity
- Availability, backup and anonymity
- Confidentiality, integrity and server authentication
- Confidentiality, anonymity and virus protection
Show the answer
Confidentiality, integrity and server authentication
No one reads the exchanges, no one changes them unnoticed, and you know you talk to the right server. TLS does not make you anonymous.
HTTPS: what is it?
Show the answer
HTTP carried inside a TLS connection
The content, path and headers are encrypted; the default port is 443.
Why does TLS encrypt data with symmetric encryption?
- It is safer than asymmetric in every case
- It is much faster; asymmetric encryption only sets up the key and proves identity
- Asymmetric encryption does not work on the Internet
- The browser does not know asymmetric encryption
Show the answer
It is much faster; asymmetric encryption only sets up the key and proves identity
Both are combined: asymmetric to agree, symmetric to exchange quickly.