SSL, TLS, HTTPS Explained

To get better at system design, subscribe to our weekly newsletter: bit.ly/3tfAlYD
Checkout our bestselling System Design Interview books:
Volume 1: amzn.to/3Ou7gkd
Volume 2: amzn.to/3HqGozy
ABOUT US:
Covering topics and trends in large-scale system design, from the authors of the best-selling System Design Interview series.

[@igwejk]

An important point that's worth mentioning, otherwise the server-hello phase would be insecure, the client and server both have a trusted authority they could rely on for authenticating each other. The client verifies the server's SSL certificate with the certificate authority that issued it. This confirms that the server is who it says it is, and that the client is interacting with the actual owner of the domain.

[@brucewayne2480]

Yes because a certificate authority verified a domain owner and signed its data with its private key, that signature is included in the certificate , and the public key of known certificate authorities are stored in the browser

[@lanyloh9876]

I was wondering about this. Thank you!

[@lawrencedoliveiro9104]

The client has a list of CA certs that it trusts, so it will accept any server cert that is signed by one of them. TLS can also be used for two-way authentication. Also for secure communication between different parts of your own organization, you can create your own CA cert and install that at the endpoints so they can trust each other.

[@alexandermiasoiedov6637]

How does the server know that the client is not the hacker that sits in the middle? Namely, how does the server knows that session_key is authentic and generated by the client, but not by the hacker in the middle?

[@igwejk]

@@alexandermiasoiedov6637 The man in the middle should not be capable of decrypting the client's message.

[@miehaga7444]

I love the audience of this channel, very polite, graceful and intellectual.

[@cassianocampes]

Direct to the point, clean, and easy to understand. Great content!

[@ReflectionOcean]

HTTPS is HTTP + TLS (Transport Layer Security) TLS is a handshake process between the client and server with asymmetric encryption to exchange a session key used for Data Transmission with symmetric encryption.

[@noorzanayasmin7806]

is the key the SSL certificate verified by Certificate Authority?

[@faultboy]

You also watched the video? Interesting!

[@geeksified]

@@noorzanayasmin7806 ​ SSL cert is the certificate you bought from your hosting or anywhere you bought it from, which contains the public key, and when you create your csr, you will be given with the verified private key that can only be paired with your public key.

[@PannasastraSR]

Your explanation is easy to understand than watch the video

[@nikhil182]

Good summary of the video!

[@barbobrien9318]

Comprehensive and easy to understand. The best part is that the video was short!

[@MohamedDhiaDerbeli]

I really appreciate the content. Simple and insightful.

[@helgarudersleben480]

bytebytego team, i would like to thank you for your videos - they are not only illustrated really well, they are really informative!

[@danielkrastev6786]

Best animation aesthetics ever. Pure joy to watch.

[@anshumansahu8476]

It is very nice and clean exlaination without messing up terminology..great job

[@thndesmondsaid]

Thanks for the video. I think you could have explained more about what TLS and SSL are specifically, but thanks for explaining in detail how HTTPS works.

[@magic_pink_horse]

You're the best presenter for this kind of stuff!

[@johnw.8782]

As always, great job. Looking forward to the next book.

[@itscheckmate878]

Best explanation I found on utube about TLS and ssl

[@ameyapatil1139]

This was so so helpful straight to the point ! Worth every second ❤

[@patricknelson]

Bravo. 👏 This is a very succinct high level explanation. I’m already somewhat familiar with the handshake, but this does a fantastic job summarizing things in an approachable fashion without diving into too much detail. Great thing is, there’s still plenty more to dive into as well and this provides a well structured guide on how to do that.

[@javalisidda7983]

🎉

[@nishantdalvi9470]

Yeah even I was confused about the how does certificate check and key exchange serially happens this video cleared my doubt

[@tesla1772]

great explantion and to the point. also tls 1.3 solves forward secrecy problem of tsl1.2

[@goldfishbrainjohn2462]

Ordered your both system interview books, volume 1 and 2. Can't wait to read the books!

[@siddharthamohan6382]

Are the books worth it?

[@goldfishbrainjohn2462]

@@siddharthamohan6382 Definitely.

[@user-ni4fs5pb3q]

it was really great fast and everything important was in this video thank you I watched more than 7 videos and put more than 1 hour to find you :) Thanks I understood everything clearly :)

[@JJVee427]

Simple, very well explained, thank you!

[@muratcan__22]

perfect straightforward. love it

[@ivanmatveev4313]

Amazing!! The best video about HTTPs, I ever seen before!

[@chriseddisford1834]

Excellent video! Very well explained.

[@sbj0880]

Very well explained - I love how soothing and insightful it is to go through your videos. How do you record these videos..curious? Thank you.

[@Djsanddy]

short and sweet tutorials really loving your channel

[@jeffg4686]

one of the best videos for overview on this.

[@asn65001]

I like that you didn't mention TLS 1.1 and below. No need to teach something that's going out the door. And thanks for pointing out the ciphers. In teaching others about TLS, I've found ciphers to be the hardest concept for people to grasp.

[@jackscalibur]

I think that everyone needs to understand the ciphers involved, but most people aren't going to be concerned with the technical details of the cryptographic algorithms.

[@bestcuts4745]

Beautifully explained. Classy video. Keep creating. !!!

[@rembautimes8808]

Excellent channel, well illustrated. A must watch for those in tech risk like me

[@wwhill8033]

Excellent explanation!! Thanks

[@bala007raju]

so nicely explained , Thanks lot , Glad I found this video and channel . thanks again

[@pjchender]

This is super clear! Thank you!

[@user-yz7ts2fq9m]

wow, great and clear explanation! Thank you very much!

[@lensimonchang]

very clear elaboration and good sharing!, Appreciate!

[@ovidiuandrei6013]

Very good explanation. Thanks man !

[@s.m.hconstantin3887]

incredible video That helped me a lot Thanks

[@MrJaved123]

Fantastic explanation.. Thank you

[@michaelbarnes9368]

beautifully presented. well done keep up the good work my friend

[@mouhssineannouri5497]

The session key isn't directly swapped between the client and server, even with asymmetric encryption. Instead, they exchange a random string of bytes, often referred to as a 'pre-master secret' or 'nonce', which serves as the basis for generating the session key on both ends using the algorithms previously agreed upon in the cipher suite exchange.

[@user-qp4gb7pb6s]

yo my moroccan bro can we contact thru fb or ig or whatsapp?

[@adilhashmi7608]

clean and easy to understand thanks for this one

[@kallenosf]

Could you tell us how you create the video animations? Thank you. Great video!

[@oah8465]

hands down, you nailed it.

[@zhujunwang1667]

Really good one! Thanks a lot!

[@prashanthb6521]

This is excellent explanation.

[@ankitsagar255]

Hi, In your System-Design PDF, one of the reasons to switch to symmetric encryption was mentioned this: "Security: The asymmetric encryption goes only one way. This means that if the server tries to send the encrypted data back to the client, anyone can decrypt the data using the public key." Is this statement correct? If yes, can you please explain?

[@zixuanzhao6043]

DH alone is prone to man-in-the middle attack. So the certification verification is vitally important which the video doesn't cover much. Basically the server send a signature which is some private-key encrypted digestion of server identity information. The client then verify the public key through chain-of-trust by layers of authorities that issue certifications (system root authority is trusted unconditionally unless your local system is messed up). Using the verified public key the client decrypt the signature and compare the result to the digest generated through the negotiated digest/hash algorithm. If everything checks out, the server identity is trusted because only the private key owner is able to generate that signature.

[@ManasRamesh]

Thanks man. Good lesson

[@ricp]

Great expalantion, thanks!

[@vitordeoliveira6139]

question: Diffie-Hellman (DH) is used for key exchange, the client and server exchange public keys and use them to generate a shared secret key that is used for symmetric encryption. Yes he share a public key also...

[@misteroy9]

Exactly, that's also my surprise he said it doesn't transfer the public key over the network. @ByteByteGo could you explain it?

[@_chris_6786]

Please, does anyone knows what is the simulations program? Thanks! And thank you for the video, outstanding explanation.

[@maruthuk]

Brilliant!👍

[@ilromape]

very nice explanation. Thx

[@juanmayen6657]

Thanks so much for this video.

[@aidataverse]

Very useful information

[@karthick9490]

May I know which tool that you used for the Illustration or to make the presentation? It is simply impressive and easy to understand..

[@davidmoody2470]

Great video, thanks.

[@EbonySeraphim]

Along with the top comment here, I think it is helpful to understand that step #2 Certificate Check involves the client cross referencing that the DNS name they resolved matches the hostname presented on the server's certificate. Otherwise, the TLS handshake will (appropriately) fail because even though the server certifcate may be valid and trusted, the server presenting it is not truly associated with it.

[@hemanthkumartirupati]

Excellent explanation

[@algovec4024]

Great video thank you!

[@nightking4615]

Sir, what graphics software do you use for making your videos? Your illustrations are so good!

[@geeksified]

If public keys are sent to the client, can this be exported somewhere and then the middle-man then creates his own request with a fully verified client cert (supposing the device was "forcefully" verified the domain it's targeting to)?

[@niuhe]

clear and helpful👋

[@richarz87]

the animation looks great. which tool do you use?

[@joelmathew5655]

one question, is rsa used to generate the session key ?

[@Mdonfor]

Thank you brother

[@GildwareTechnologies]

SSL, TLS, and HTTPS are all cryptographic protocols used to ensure secure communication over the internet. They play a crucial role in protecting sensitive data transmitted between a client (such as a web browser) and a server. Let's explain each of these terms: SSL (Secure Sockets Layer): SSL is an older cryptographic protocol that was initially developed by Netscape in the 1990s. It was widely used to provide secure communication over the internet, especially for websites handling sensitive information like login credentials or credit card details. However, due to security vulnerabilities and weaknesses found in SSL, it has been largely deprecated and replaced by its successor, TLS. TLS (Transport Layer Security): TLS is the successor to SSL and was introduced as a more secure and robust cryptographic protocol. It operates at the transport layer of the internet communication stack and ensures secure data transmission between a client and a server. TLS uses a combination of symmetric and asymmetric encryption algorithms to establish a secure connection. The latest version of TLS at the time of writing is TLS 1.3, which has further improved security and performance over previous versions. HTTPS (Hypertext Transfer Protocol Secure): HTTPS is not a separate protocol but rather a combination of HTTP and TLS (or SSL in older implementations). It is the secure version of the standard HTTP protocol used for transmitting data between a client's web browser and a web server. When a website uses HTTPS, it means that the data exchanged between the client and the server is encrypted using TLS or SSL, ensuring that it cannot be intercepted or tampered with by unauthorized parties. When a user connects to an HTTPS-enabled website, the following steps occur: The client (web browser) sends a request to the server, indicating that it wants to establish a secure connection using HTTPS. The server responds with its SSL/TLS certificate, which contains the server's public key and other details. The client verifies the authenticity of the certificate by checking its validity and whether it is signed by a trusted Certificate Authority (CA). If the certificate is valid, the client and the server perform a handshake to negotiate the encryption algorithm and establish a secure connection. Once the secure connection is established, all data transmitted between the client and the server is encrypted and secure from eavesdropping or tampering. In summary, SSL and TLS are cryptographic protocols used for secure communication, with TLS being the more modern and secure version. HTTPS is the combination of HTTP and TLS (or SSL) and is used to ensure secure data transmission over the internet, especially for sensitive information. Enabling HTTPS on websites is crucial for protecting user data and ensuring a safe browsing experience.

[@HazzyDevil]

LMFAO, did you really just get chatgpt to give you the answer? 💀

[@MarcioLaubstein]

Very nice visuals!

[@behrad9712]

Thank you very much!🙏👌

[@hjxy2012]

Thank you. And how do you draw these magic architecture pictures?

[@nicolepierce2517]

Very interesting need to know

[@vincat84]

great video! thanks!!

[@shortest-nerdev-eugene]

I have a question about TCP Connection while client surfing the web site. As I understood, when client connect to the web server as a first time, then the task, as the video explained, will be proceeded between client and server side. After once the client & the server release their connection, TCP Close, Is the client and the server have to re-proceed the progress? Or the client just can use the exist Asymmetric & Symmetric keys?

[@venkybabu8140]

Public keys were trapped sometimes and that's why no public keys travel. Mostly by NAT re-config. SSL means a set of algorithms accepted between with certificate means that the binary coded files used for decryption. Key means algorithm. Why public and private keys means that public used for encryption of the algorithm of choice and private is end to end algorithm transfer and use. About a thousand algorithm exchanges for a single transaction. So don't try.

[@atillaattila8900]

Thanks for information

[@johnjacobjinglehimerschmid3555]

Can the above listed communication between client and server. Can it be seen in something like wireshark? If yes could an example be shown?

[@sabuein]

Thank you.

[@lucasguaru]

I have a question. When this hand shake happens? It does for the first request and keep this connection stablished for the next calls or it does for every request? Im having difficult to imagine it if we have clusters, if the connection is kept alive.

[@tomlee1176]

Thanks Lam

[@JosefdeJoanelli]

I got very confused around the start of step three when you were saying "a symmetric" and "asymmetric" a lot hehe

[@basitalkaff]

How you create these content animations? Can you give us some details about that?

[@alaaalasi]

What tool are you using to present the tutorial? Very nice 👍

[@rikybarbe]

Hi, thanks for your videos, very helpful. I'm writing my master thesis and I'm looking for a way to compare TLS cipher suites about their computational cost. My main idea is about counting number of operations and related weigth for each algorithm in every cipher suites, but I can't find any information about these metrics or just a tool to implement RSA (e.g.) and understand the computational weigth, in order to compare the main cipher suites. Can you or anyone else give me any input to implement this metric? Many thanks

[@murali1790able]

Here server means Load balancer- correct? There might be 100s of hosts running behind load balancer. Does client establish connection to one of those hosts or the front facing load balancer?

[@caiohenrique5587]

How do you make those video animations ?

[@tonycheung5532]

great video

[@why901018]

Perfect !

[@yash1152]

4:41 >_"as with most optimizations; it's a bit harder to explain"_ glad go be reminded of it (:

[@sss-nl1uu]

which animation software you used to create this video?

[@siddharthsorout3446]

bytebytego team, i would like to thank you for your videos , really informative!

[@ciarancallaghan3810]

Love the videos. What software do you use to make the video animations?

[@mario_luis_dev]

i have the same exact question..These animations are so clean

[@RaviChandraEnaganti]

@@mario_luis_dev In some other videos, it is mentioned that He uses Adobe Illustrator or some other adobe product.

[@Jacry-lt4xl]

May I know what tools do you use to create this animation? Thanks!

[@hlexjava]

Question - so if we have private key. We can decrypt tcpdump file?

[@aquarius2642]

Wonderful video explaining the internal working of SSL TLS. This got me wondering that about what other questions related to HTTPS SSL TLS do web developers need to know the answers to to be able to do their jobs. I doubt they need the internals of how HTTPS SSL TLS work. Web developers just need to understand 1. Libraries that enable http requests and responses - client side and server side. 2. What are the steps in getting a certificate 3. what sort of attack are prevented through this kind of encryption 4. what are the libraries objects methods that enable https on both client side and server side 5. what are the steps relevant to setting up https tls and ssl on self hosted and cloud hosted servers

[@QueeeeenZ]

HTTPS is not a protocol technically, it is a scheme. The protocols used are actually called HTTP and TLS.

[@ArtemShaban]

Awesome!

[@viet-anhduong6887]

Nice video

[@ozilmatrix6334]

Am I correct in saying TLS1.3 uses Symmetric encryption for key exchange since DH is symmetric?

[@bunthaideng2492]

Is there the step verify the certifcate with CA?

[@ruthwikd311]

Great explanation , but please be loud next time

[@husseinismailhozza]

I like the videos of ByteByteGo 🙂. You have clean diagram, may I ask what tools they are drawn with?

[@Abdirahmaann]

Waa videoScribe baan umalayn

[@bronifty598]

i think TLS 1.2 is the best version currently as 1.3 has a security vulnerability in its supply chain (one of its dependencies that is unique to the version i believe). This is according to recent software engineering daily podcast with guest Ilkka Turunen

[@shankar4393]

in this video which version did he explained 1.2 or 1.3