Advanced › Module 7 › Lesson 1
TLS Handshake Named
TLS handshake literacy — ClientHello, ServerHello, cert chain, key exchange — read with openssl s_client on example.com.
Visual · t28_tls_handshake_named
TLS handshake = named message flow. example.com read OK. $CRYPTO_LAB. Original Cyberlium.
Opening
TLS trust is negotiated message by message — name the handshake stages on a public chain read before you review any finding.
TLS handshake literacy names: ClientHello (version, cipher list, SNI), ServerHello (selected version/cipher), Certificate message (server chain), ServerKeyExchange if applicable, ClientKeyExchange, Finished messages, optional client cert in mTLS. Analyst follows openssl s_client -connect example.com:443 -servername example.com output and packet diagrams at literacy level — understands where cert validation and key agreement occur — without MITM cookbooks on production apps or SSL-pinning bypass on apps you do not own. Cyberlium on $CRYPTO_LAB toy TLS captures and public example.com read. Refused: stranger Wi-Fi MITM, production banking intercept, downgrade attack scripts against live targets. Lab row: six handshake messages with one security property each.
1. Named handshake messages
ClientHello → ServerHello → Certificate → key exchange → Finished — literacy sequence.
SNI carries intended hostname — mismatch breaks validation on modern clients.
Command guide
Try these commands — Named handshake messages
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL s_client — https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html
RFC 8446 — https://www.rfc-editor.org/rfc/rfc8446 (TLS 1.3) RFC 5246 — https://www.rfc-editor.org/rfc/rfc5246 (TLS 1.2)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl sudo apt install curl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | head -20
python3 -c "print('TLS literacy: inspect public handshake to example.com — not MITM stranger traffic')"Primary tools to practice this lesson: openssl, curl. Reference sites: OpenSSL s_client (https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html); RFC 8446 (https://www.rfc-editor.org/rfc/rfc8446); RFC 5246 (https://www.rfc-editor.org/rfc/rfc5246). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Trust breakpoints
Cert chain validation, hostname check, signature algorithm, key exchange strength — defender review points.
TLS 1.3 simplifies handshake — note version in lab output.
3. $CRYPTO_LAB boundary
Handshake notes from example.com read or $CRYPTO_LAB capture — not unauthorized MITM.
Refused: production intercept, pinning bypass cookbooks, live downgrade attacks.
4. What you ship: TLS handshake literacy card
Six handshake messages + security property each + NEVER prod MITM line.
5. What you record before the next lesson
TLS handshake literacy card path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
MITM employer banking app TLS to 'map handshake messages.'
Right
TLS handshake card from example.com or $CRYPTO_LAB capture. Next: Cipher Suites.
Mission: TLS handshake literacy card
1) Name six handshake messages. 2) One security property per message. 3) Note SNI role. 4) Write NEVER prod MITM line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “TLS 1.3 vs 1.2 — handshake count?”
Knowledge Check
APPLY: TLS handshake literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Production MITM is course lab.
True or False
Knowledge Check
APPLY: SNI carries:
Multiple choice