TLS Handshake - EVERYTHING that happens when you visit an HTTPS website

[@PracticalNetworking]

📢 *Black Friday / Cyber Monday Promotion* 👉 Practical TLS for only $50 (originally $297) 💻 Use code *BFCM2024* --> pracnet.net/tls 📅 Offer expires Dec 6

[@dilipbalaiyan6268]

I should salute for all your efforts of these videos. It's really helpful for me. You're massive of crispy to the point. I don't know where I can give you kudos for your work.. Thanks a lot.

[@PracticalNetworking]

@@dilipbalaiyan6268 Glad you are getting a lot out of this content. If you're really wanting to help, the best way is to spread the word about this content =). Shares on Twitter/LinkedIn/Reddit are greatly appreciated. Cheers, Dilip.

[@dilipbalaiyan6268]

@@PracticalNetworking definitely

[@PracticalNetworking]

@@dilipbalaiyan6268 Thank you kindly =)

[@cslb38]

Its worth every penny, such a small price vs large reward! Great work Ed!

[@AliYahyaabadi]

I wanted to take a moment to thank you for your incredibly helpful tutorial on TLS/SSL. I'm so grateful that you took the time to create such a detailed and informative resource.

[@PracticalNetworking]

You're very welcome. If you want more, you might also enjoy the full TLS course as well.

[@chiefriver]

Thanks for all your quick responses here and on Twitter! Until I buy a class just wanted to say thanks as you are great at fulfilling your mission of bridging the gap between overly technical documentation, RFCs etc and simplified examples that leave us with more questions than answer!!! Keep it going and thanks again!!

[@PracticalNetworking]

Thanks for the kind words. Glad to help. Thanks for supporting the channel =)

[@KannanBalasubramanian-y7x]

One of the absolute best training videos I've watched in the recent past! The author seems to have an impressive understanding of the audience new to the topic. Pacing of the video is spot-on for me, making the learning experience truly captivating

[@umairsafdar7444]

One of the best and highly detailed explanations of TLS Handshake. Thanks for putting this out for free !!

[@PracticalNetworking]

Thank you for the kind words. You're very welcome, Umair.

[@ivanshmilyk7614]

I kept struggling with those 5-6 min long videos on TLS/SSL handshake and was sure I needed to find a longer all-in-one video, and yours is really by far the best explanation here, thank you, I hope KZbin's algorithm will recommend this to more people who search on this topic

[@alirezajalali9265]

after all these years in IT , now I fully understand TLS . thank you so much

[@KrishnaChrist]

Hey someone, can you please come back & remove your 'single' DISLIKE from this video please. This insightful video doesn't deserve dislike at all.

[@PracticalNetworking]

Seriously! ;p

[@scottspa74]

As someone lucky enough to have won access to the full TLS course, I have to agree that there is enough detailed content in it to answer any questions a person may have after watching this. Excellent course! Definitely worth the cost! 👍 Really, really looking forward to 1.3 with quic.

[@PracticalNetworking]

Thanks for the kind words, Scott =).

[@TechLord79]

Excellent!!! I needed/wanted to know TLS at that level. I do, however, have to research the certificate chain part - from practical experience and industry-renowned services like Qualys SSLLabs it is expected to configure a web server with its certificate and the CA chain EXCEPT the root certificate! Because the root CA is a trust thing the client (browser) has to assess on its own anyway but the diversification in intermediate CA hierarchies and (internal) technical requirements of a specific CAs is something the client cannot know in its entirety. So we "make a ladder" for the client up to the root.

[@the-sunny-side-up]

The most precise explanation of TLS handshake, I have ever found!! Thanks for making my life easy.

[@jerrygowen1604]

THANK YOU!!! so many different videos separate everything and its hard to really understand the whole topic and how it fits together. Thank you for doing what nobody else does

[@justsomebody14]

This is a gem! Thanks for your free course!

[@mujahid509]

Lucky to come across this explanation..best for SSL handshake

[@satishbabugudapati9741]

This was beautiful video on internet. Thanks Ed

[@PracticalNetworking]

Glad you enjoyed it, Satishbabu!

[@jaishankarpatil4554]

The best ever TLS Handshake Explained..

[@AbhishekD538]

Really appreciate all the work you do! This was very helpful, clear and detailed at the right level of abstraction. Thank you. 🙏

[@rahmounmedelmahdi4181]

you know the video is good when you spend 2 hours on watching 30 min good job. I wish there were free access to the rest of the content.

[@PracticalNetworking]

[@DG-fs1pq]

I finally purchased your Practical TLS class last night. Ready!!!

[@PracticalNetworking]

Awesome! Welcome to the course!

[@rudrasalaria3431]

As always you clear my doubt aboutTLS 1.2. Thank U Sir. Lots of Love from india. ❤️🇮🇳

[@PracticalNetworking]

You're welcome, Rudra. =)

[@power8667]

The best explanation of the concept on the internet I have seen! Thank you.

[@infomoreandmore]

This is the best explanation so far I got around SSL handshake. Thanks a lot!

[@TechChefMM]

Simply and ABSOLUTELY fantastic content! I’m sold and now a paid course subscribed student looking forward to consuming ALL the content and putting it to practical use! Kudos! MM

[@PracticalNetworking]

Glad you enjoyed it, Michael =)

[@MohammadJK197]

very detailed and easy to understand. This was awesome, thank you

[@am2427]

That was a really rough ride. But I'm glad I went through with it. Thanks for the video!

[@CyberTronics]

Beautiful can’t wait for the TLS 1.3

[@PracticalNetworking]

Thank you, Hamza.

[@jhde9067]

I'm glad I subscribed to the channel after finding the website.

[@PracticalNetworking]

Me too =)

[@RowenaReddragon]

you are hands down the best teacher! i cant thank you enough. truly grateful 🙏

[@PracticalNetworking]

You're very welcome! Hope to see you in the full course soon!

[@emonhossain4353]

Thank you

[@ericschneider2546]

OMG! Thank you so much!!! This was EXACTLY the video I needed to understand what was missing, and I was looking for it so badly! Best explanation ever!

[@mikoajszczepaniak5134]

The best solid tutorial i have ever watched. Congrats 😅

[@liloneoro]

This is a great video. Thanks a lot. You made everything very clear.

[@ankitsharma-ef3cs]

OMG !! What an explanation Ed. This is the best content for TLS-Handshake and i'm so glad to find. Lots of love from INDIA 💌

[@PracticalNetworking]

Cheers Ankit. Glad you enjoyed it =).

[@ivhacks]

You have a small mistake: Session ID is variable length and can be up to 32 *bytes*, not 32 bits. See page 40 of RFC 5246. Otherwise amazing video. Thank you so much, really helpful to prep for my interview tmw :)

[@ДаряКалитюк]

Hi! I study cryptography and your videos are the best in the whole Internet! Could you please specify the exact way of combining pre-master key\master-key with random values and strings before putting them into PRF? With love from Ukraine

[@h.b.7190]

I want to Thank you for all the content you made to create such a wonderful playlist. It took me a while to understand whats going but it all makes sense. It’s so fascinating and it blows my mind that smart people created a secure tunnel for secure communications. Me in my 30s as a employee in a facility management company trying to make a step into information technology and let my path of life go in a new direction. Unfortunately I can not afford a full TLS course from your website but let me spend you a coffee at least. Thank you so much man. God bless you Is there name of your song you always use for intros? I would like to listen to it, while thinking about the TLS handshake step by step 😊

[@PracticalNetworking]

Thanks for the kind words, and thank you for supporting the channel. I'm at the gym at the moment, and don't recall what song I used in this video. But if you reach out to me on discord, I'll tell you the song... And gift you a scholarship to the course.

[@kervinsingh6213]

Hi Ed, at 8:40, i have the below questions: 1. Does the server always provide the root CA in the certificate chain? 2. if the intermediate CA is not provided by the server, how does the client decrypt the digital signature? 3. if the server provides the root CA, does the client use the public key of the root CA provided from the server, or the public key from the Client's own CA cert store? (i assume it's the latter)

[@Felitsius]

Wow that was such a good explanation! Thank you heaps, I wish my tutors had a similar skill to transfer knowledge - it is a skillset of its own!

[@yared09]

Crisp and clear explanation ever!

[@muhammadumarwaseem]

You sir, are a legend! Great video, well explained.

[@poojarrao]

This is by far the best explanation I’ve seen on the internet. Thank you so much for sharing!! I’m sure this video has helped a lot of us here :)

[@arturpopielski7051]

Great video as always Ed! Since you're using the RSA key exchange, does this version of the handshake support PFS?

[@cslb38]

Yet again an amazing demonstration of excellence!

[@PracticalNetworking]

Thank you! Cheers!

[@shajigopinath]

One of the best session which i watched. Thanks for the detailed and clean explanation.

[@amzathblaiseyehouessi7028]

I hit the LIKE button 6 times to give you tha round of applause. You actually deserve it more than me. Thank you!

[@PracticalNetworking]

Thanks for the kind words and your support =) And the six likes ! ;)

[@aniruddhsharma8342]

Must say that if we were to speak of only the Handshake then this is the best video, would request you to cover the Certificate Change of Trust, Record and Alert Protocol as well. Thank you

[@PracticalNetworking]

GLad you enjoyed this video, Aniruddh! The rest of those topics are covered in the full course!

[@orilio3311]

absolutely incredible video. this is the one greatest explenation of TLS I've managed to find. thank you! I hope my cyber security course test score will show I've understood the protocol :)

[@PracticalNetworking]

Thank you for the kind words =) Glad you enjoyed it!

[@ghinwabadawi983]

best explanation about TLS Handshake! loved it!

[@trailerhaul8200]

Man 100K subscribers. It was way less a year ago. You are Networking great :))

[@PracticalNetworking]

Progress has been slow and steady, but it finally got to 100k =). Excited to see where it goes next !

[@shawnhan8122]

just would like to clarify that the process described in this video is for key exchange algorithm using RSA right? If DHE is used, the server key exchange (with the DH public paramaters) message should be sent after the certificate record and before the server hello done record.

[@PracticalNetworking]

Yep, correct. I outline a DHE KX in this twitter thread: twitter.com/ed_pracnet/status/1618272854667309058

[@scottspa74]

I'll DEFINITELY be rewatching this! Also, great way to incentivize yourself to finish up TLS 1.3 👍😁 Can't wait for that!

[@PracticalNetworking]

=)

[@pixelmage3523]

holy fuck this blew my mind as to how easy it was to understand it

[@PracticalNetworking]

Anything can be easy if it's explained well. Glad you enjoyed this video =)

[@mharis6728]

Thanks for this video. I have a question related to session keys generation. How Master Secret, Client and server random and "key expansion" are used or combined in order to generate these 4 session keys? My second question is how Master secret is actually generated? You said we combine Pre-Master secret, client and server random and "Master Secret" but what mechanism or algorithm is used to generate it?

[@karamjeetpadam4719]

Thanks much for the free video.

[@misha2082]

Wow. What a great video. I definitely learned something new today about SSL keys

[@nishantdalvi9470]

This vide is awesome 💯 just having a little doubt from where did that key expansion field come which is been used for the formation of the session keys

[@matiashuartamendia7977]

so RSA only here for key exchange? no encryption other than symmetric keys? is it then that the symmetric cipher comes into play with the keys to encrypt the payloads? is the hashing of handshake determined by cipher suite selecion for example SHA1?

[@PracticalNetworking]

Correct. RSA just facilitates the key exchange, and signatures. It doesn't do any real encryption of data sent being client and server. Yes, hashing is determined by Cipher Suite selection.

[@kienphan6436]

Excellent work. Thank you.

[@alfiogiuffrida1007]

Great course! Very well explained. Thanks!

[@jhde9067]

OMG THANK YOU SO MUCH, I NEEDED THIS. Not sure many made it as clear and detailed as that.

[@PracticalNetworking]

Glad this helped =). Please feel free to share it if you know others that might also benefit from this.

[@gedankenthesis]

This explanation was absolutely amazing! Thank you so much!

[@PracticalNetworking]

You're welcome, Arvind !

[@estebanechavarria5609]

I was so shocked about all the things that are being done behind the scenes when you access an https website that I'm thinking that I would be exhausted and do not want to exchange data anymore after that long handshake haha

I just wanted to say thank you for your amazing tutorial on TLS/SSL. I really appreciate the time and effort you put into making such a comprehensive and informative guide.

[@chiefriver]

Any videos doing a similar walk through but with Diffiehellman key exchange? Specifically on and where in the flow the client verifies that the server does possess the long term private key that corresponds with the earlier served x509 cert? Because it doesn't need to send a premaster secret like RSA where is this same validation check performed with Diffiehellman? Ex 11:10

[@PracticalNetworking]

Great question! I don't have a video answer but the pinned post on my Twitter is exactly what you asked for: a walk through of the TLS handshake using diffie hellman as a key exchange. =)

[@vijaybaskar2862]

Ed... please refer the video @11.26...what if the middleman sends server his own pre-master-key encrypted using server's public key. I guess server's public key is available to everyone. In this case, how does the server ensure's that the pre-master-key (encrypted with server's public key) it receives is from the actual client and not from someone else. BTW thanks for the video Ed.

[@cvasilak]

excellent description, thank you!

[@PracticalNetworking]

You're very welcome, Christos!

[@olsikapoli6287]

Great course Ed! I have a question on the Cipher Suites used (trying to go through the comments if it was asked before, but can't seem to find it, therefore I apologize for asking "again"). In TLS1.3, all RSA encryption and RSA cipher suites have been removed. The video started by Client having TLS1.3, but did not mention TLS1.2 libraries as well. Is it assumed in this course that Client and Server have both 1.2 and 1.3 for this handshake to work for this course?

[@tanmoymallick8244]

did you upload the video for the packet capture of tls handshake that you said here ???

[@rajrajesh]

Great video. For @17.00 - Can you please help clarify if the client encryption key gets generated individually at the client and the server? If so, client and server have the same set of 4 pieces of information (Master Secret, key expansion, Client Random, Server Random) that is used for the random hash function. But how is it guaranteed that the random hash function returns the same value both at the client and the server?

[@PracticalNetworking]

The nature of Hashing is that if the Client and Server hash the same pieces of information, they will receive the same output. That is what is happening here, and how the encryption keys calculated by both Client and Server end up being identical.

[@nikbura9500]

@@PracticalNetworking To Clarify this further, does this mean that the Client keys are generated using the client random number and the server keys are using the server random number to be generated? otherwise how can you make two sets of keys individually on each host and ensure both sets are the same?

[@Whowhatsit]

Gunna be using this for my brown bag report at work, big thanks for the save!

[@duckduck9954]

One of the best explanation

[@sarathreddy844]

Highly knowledgeable content!

[@atabhatti6010]

At 5:56, the slide says Session Id in the Server Hello is 8 bytes / 32 bits? Is that right? Aren't 8 bytes 64 bits?

[@PracticalNetworking]

Yea, that's totally a typo. Someone mentioned this in my discord as well. It should say any range in 0-32 bytes. In reality, there is one field "Session ID Length" which is always 1 byte (8 bits, values 0-255, of which only 0-32 are valid) which indicates how long the actual "Session ID" field will be.

[@avinashs8236]

does tcp handshake (sync, syn-ack, ack ) happen before this ssl/tls handshake when a user visits a website

[@PracticalNetworking]

Yes, typically. There is a version of TLS over UDP that doesn't involve TCP 3 way handshake, but generally most TLS does. I have some videos on TCP here : pracnet.net/tcp

[@edwinjose1885]

Could you help clarify what's been explain at 14:40? The concept of two tunnels. Up until that point you've been saying that the keys both the client and the server have are identical. But you go into how TLS creates two tunnels and they are encrypted with two different pair of keys, and that even if one of the tunnel's been comprised, the attacker can only decrypt that tunnel and not the other. How does that work? Aren't both set of keys the same?

[@edwinjose1885]

I think I may have understood it. BOTH the CLIENT and SERVER generates a SEED for it's respective tunnels that BOTH perform a RSA Key exchange for. Correct me if I'm wrong.

[@bd5387]

Awesome! Thanks man. Great stuff.

[@aleksandrkubar6255]

Perfect explanation, thanks!

[@kevinlupien9520]

Always high quality content. Thanks!

[@negrastormentas2865]

Thank you so much for this series.

[@zerooneservices]

Thanks for such an informative video.

[@PracticalNetworking]

Glad you enjoyed it =)

[@joetecson]

Q: If a client initiates TLS 1.0 to a server and gets denied, will it open a new stream to renegotiate the higher TLS with the server or will it use the same quintuple stream on renegotiation?

[@rico5342]

How long does this to-and-back TLS handshake procedure take ?

[@VSHALETC]

Hello Ed, When you are going to add this course on Udemy?

[@user-ds2yw2ct9n]

A very good lullaby!

[@saravananm9783]

Great content😊😇.. But, .I stucked in some points.. What is exactly "masterkey" inside the "pre-master key". And then "servers finished".? Is that same value both side?

[@PracticalNetworking]

"pre-master-key" is a random value generated by the client (at least, with the version of the handshake illustrated in the video). This random value is combined with other values to create the "Master Secret". Which is then combined with yet other values, such as the literal string "Server Finished", to create the actual Session Keys

[@saravananm9783]

Thanks😊..

[@mortezarezaei3006]

Thanks for the informative video.

[@PracticalNetworking]

YOu're welcome, Morteza!

[@m.reveller]

Why do we need to generate master secret from pre-master secret + client random + server random? Why can't a client generate a master secret right away and encrypt it with server's pub key?

[@riadali1775]

Thank you so much! your video really helped alot. can you make video related to DNS management as well?

[@vishal57971]

My question is client send lists of cipher suite to server. What mechanism is work on server side and server choice one of cipher suite that client send in hello message

[@radhakrishna2501]

Thanks a lot Ed! I have a query regarding slowness issue between two servers (these servers residing in DC and branch office and communicating via meraki vpn) this issue occuring after upgrading our gear to meraki not sure what's the issue here could you help me with some troubleshooting steps please Thanks in advance

[@PracticalNetworking]

That seems pretty involved, much more involved than what is appropriate for KZbin comments. You can try to ask in discord (pracnet.net/discord) but the issue is borderline something that would require hiring a consultant (which, I'm available for, if you are interested).

[@radhakrishna2501]

@@PracticalNetworking thank you for the reply Ed! It indeed need consultant view will have a word with my manager on this and get back to you thank you again

[@VSHALETC]

Simply great! Is it possible for you to make small introduction video on web3?

[@PracticalNetworking]

Web3 is on my list to cover, at some point. But a lot is in front of it =/

[@abdallahezat8604]

This is awesome!

[@chrisfahie2767]

Wow thank you so much that really helped

[@PracticalNetworking]

Glad you enjoyed it =)

[@babai08]

U better live 100 more years ❤️❤️

[@PracticalNetworking]

=)

[@vennilac427]

Fantastic !!! work

[@bernardoolisan1010]

This is amazing, but people... why can't we just trust each other!

[@PracticalNetworking]

Wouldn't that be much easier ;)

[@jyothibabugummapu1365]

Awesome...thanks alot

[@silentrandom]

Awesome content. Session Id 8 bytes or 64 bit. Just typo I guess

[@PracticalNetworking]

Yes, it's a typo, good catch =). I clarify it in the TLS 1.3 handshake lesson in the course.

[@constantincoach372]

Love the content

[@santozard]

Best of best!

[@Sharing.learnings]

Great content