<aside> 🧭

Module 01 · Why TLS Exists — Crypto Primitives & Your Lab

Everything in this track — certificates, chains, handshakes, revocation, ACME — is built out of exactly four ideas. This module teaches those four ideas starting from nothing, shows you the gap that certificates were invented to fill, and builds the lab you will use for the next thirteen modules.

🧠 concept → 🧪 exercise → ✅ expected result (hidden) → 🎯 interview questions (answers hidden)

Prerequisite: none — this is the first module. You need a Linux machine (macOS or WSL2 is fine), the ability to run sudo, and nothing else.

</aside>

Part A · The problem TLS solves

A1 · What is actually on the wire

<aside> 📖

Official docs: RFC 8446 — The Transport Layer Security Protocol Version 1.3 · RFC 8446 §1 — Introduction and security goals · TLSRef — Server-Side TLS guidance

</aside>

<aside> 📬

The analogy — a postcard through the post.

Write a message on a postcard and drop it in the box. Every person who handles it on the way can read it. Any of them could rub out a word and write a different one. And worst of all, someone could bolt a fake postbox to the wall outside your house, and you would post your letters straight into it without ever noticing.

Those are the three problems below, in order. HTTPS is the difference between a postcard and a sealed, tamper-evident envelope handed to a courier whose ID you actually checked.

</aside>

When you open http://example.com, your machine opens a TCP connection to port 80 and writes bytes into it. Those bytes are ordinary readable text. Your router sees them. Your ISP sees them. Every transit provider between you and the server sees them. The switch in the destination rack sees them.

This is not a bug or an oversight. TCP was designed to move bytes reliably, and HTTP was designed to be human-readable. Neither of them was ever designed to hide anything or to check anything. That is the entire vacuum TLS was created to fill.

There are three separate problems here, and it matters enormously that they are separate, because TLS uses a different mechanism for each one.

Problem	What the attacker does	What fixes it
Eavesdropping	Silently reads your bytes as they pass. Leaves no trace at all — you cannot detect it	Encryption (Part B1–B3)
Tampering	Changes bytes in flight — swaps a bank account number, injects a script into a page	Hashing / integrity checks (Part B4)
Impersonation	Answers instead of the real server, and you never know	Certificates (Part C — and the other thirteen modules)

<aside> ⚠️

This is the single most counter-intuitive idea in the whole subject, so read it twice.

Encryption on its own does not stop impersonation. If an attacker answers instead of your bank, and you encrypt your password to the attacker's key, you have had a beautifully confidential conversation — with a thief.

Encryption guarantees nobody else can read this. It says nothing whatsoever about who is on the other end. Certificates exist to answer that second question, and that is why this entire track is about them rather than about ciphers.

</aside>

flowchart LR
    U["💻 Your laptop"] --> R["Home router"]
    R --> I["ISP"]
    I --> T["Transit<br>networks"]
    T --> D["Datacentre<br>switch"]
    D --> S["🖥️ example.com"]
    M["🕵️ Anyone on this path<br>can read AND rewrite<br>every plain HTTP byte"] -.-> I
    M -.-> T
    style M fill:#ffcccc,stroke:#cc0000,stroke-width:2px
    style U fill:#cce5ff,stroke:#0066cc
    style S fill:#cce5ff,stroke:#0066cc

🧪 Exercise A1.1 — Watch a password cross the wire in plain text

Open three terminals. This runs entirely on your own machine, so it is completely safe.

# Terminal 1 - a throwaway web server on port 8080
mkdir -p ~/tls-lab && cd ~/tls-lab
python3 -m http.server 8080

# Terminal 2 - watch the loopback interface
# (on macOS use -i lo0 instead of -i lo)
sudo tcpdump -i lo -A -s 0 'tcp port 8080'

# Terminal 3 - send a request carrying credentials
curl -s -u john:hunter2 <http://127.0.0.1:8080/quarterly-salaries.csv> > /dev/null

✅ Expected result — click to reveal

🧪 Exercise A1.2 — The same look at an HTTPS connection

# Terminal 1 - capture (use your real interface: eth0, ens3, en0, wlan0...)
sudo tcpdump -i any -A -s 0 'tcp port 443 and host example.com'

# Terminal 2
curl -s <https://example.com/> > /dev/null