Menu

Topic

TLS and HTTPS

TLS is the protocol behind HTTPS. In TLS 1.3 both sides agree a fresh secret with ephemeral key exchange (ECDHE), the server proves who it is by signing the handshake with its certificate's key, and fast symmetric encryption then protects the data.

This hub starts with the ideas underneath (shared keys and key exchange), then covers the handshake, server configuration and the protocol errors you see when the two sides cannot agree.

Understand it: handbook chapters

Plain words first, then the real mechanism, what it looks like at work and why it matters.

Chapter 15

The TLS 1.3 handshake

In one round trip, client and server agree fresh keys with ECDHE, the server proves it holds the certificate's key by signing the handshake, and both confirm nothing was altered.

  • Developer
  • IT ops
  • Expert

Chapter 1

Symmetric encryption: one shared key

Symmetric encryption scrambles data with one secret key, and only someone who holds that same key can turn the scrambled data back into readable text.

  • Beginner
  • Developer
  • IT ops

Chapter 2

The key-distribution problem

A shared secret key must reach each partner without anyone else seeing it, and every pair needs its own key, so sharing secret keys does not scale.

  • Beginner
  • Leader
  • IT ops

Chapter 4

Key exchange and hybrid encryption

Two parties can agree a shared secret over an open network without ever sending it, then derive fast symmetric keys from it to protect the actual data.

  • Developer
  • IT ops
  • Beginner

Chapter 23

Both sides show ID: mutual TLS

In mutual TLS the client also proves who it is, with a certificate and a signature from its private key, so both ends are authenticated before any data flows.

  • IT ops
  • Developer
  • Expert

Do it: how-to guides

Step-by-step, with real commands and a way to check it worked.

How to install a certificate in nginx

nginx serves your certificate and its full chain on port 443, with a key that matches, and you have proved it from the outside with OpenSSL and curl.

  • Linux
  • nginx

How to install a certificate in IIS

IIS serves your certificate with its private key and intermediate on an HTTPS binding with SNI, and renewed certificates get rebound instead of silently expiring.

  • Windows
  • IIS

How to set up mutual TLS (nginx and curl)

You will have an nginx endpoint that accepts only clients holding a certificate from your own client CA, lets in only the clients you name, and is tested with curl.

  • nginx
  • Linux
  • Windows

How to test post-quantum hybrid TLS

You will know whether your servers and network negotiate the X25519MLKEM768 hybrid key exchange, and how to read, force and troubleshoot it with OpenSSL 3.5.

  • Linux
  • macOS
  • Windows

Fix it: error pages

The exact messages tools and browsers print, with likely causes and safe fixes.

Check yours: browser tools

They run in your browser. Nothing you paste is sent anywhere.

Tool

Chain checker

Paste a chain and see which link is missing, expired or out of order.

Tool

Hostname matcher

Test whether a name matches a certificate's SANs and wildcards.

Tool

Paste your error

Paste a certificate error from any tool and get the page that explains it.

The big picture: crash course

Short lessons of about nine minutes each, with check questions.

Look it up: glossary terms

Every term in plain words, linked to its full entry.

Other topics