TLS/SSL Explained: How It Works and What to Look For
TLS protects application traffic with authentication, confidentiality and integrity. SSL is its older predecessor.
Published by Protocol Explorer · Reviewed
How TLS/SSL works
In TLS 1.3 the client and server negotiate parameters and keys in a handshake. The server typically proves its identity using a certificate and a signature.
What to look for in an exchange
Handshake messages and protected application data serve different roles. Version and cipher negotiation differ across TLS releases; older SSL versions should not be assumed secure.
Follow an example step by step
- Identify the ClientHello and its supported versions and extensions.
- Follow ServerHello and the authenticated handshake messages appropriate to the negotiated TLS version.
- After the handshake, distinguish encrypted application data from the earlier negotiation.
Common interpretation mistake
TLS 1.3 and older TLS versions have different handshake details; do not assume every trace has the same messages.
Key point to remember
Certificate validation checks identity and chain trust, but a valid certificate does not guarantee that a website is benign.
Explore the protocol
The TLS/SSL overview is free without an account. Its full interactive lesson is included in Protocol Explorer Pro, a one-time $4.99 purchase; an account is required to buy Pro and restore the licence across devices.
Open Protocol Explorer · Compare Free and Pro
Specification
Read the primary specification for TLS/SSL for the authoritative protocol details. The interactive scenario is a simplified teaching model, not a capture of your network.
Continue learning
How to read a packet · TCP · UDP · HTTPS