TLS/SSL Deep Dive
Inspect and build real TLS connections with OpenSSL, understand exactly what the TLS 1.3 handshake achieves and why TLS 1.0/1.1 were formally deprecated, and write a scanner that audits which protocol versions and ciphers a set of servers actually offer.
Prerequisites: Completion of Public Key Cryptography and Hashing and Digital Signatures; OpenSSL installed (openssl version to check); Python 3.10+ for the mission step.
Verified against RFC 8446 (TLS 1.3), RFC 8996 (formal deprecation of TLS 1.0/1.1, March 2021), and current OpenSSL release documentation, July 2026. OpenSSL's current major release is 4.0 (released April 2026; 4.0.1 as of June 2026), though OpenSSL 3.5 — an LTS release supported until April 2030 — remains widely deployed and is what most current OS package managers ship. Every openssl command in this project is stable across both the 3.x and 4.0 command-line interface; none of the removed features in 4.0 (the legacy ENGINE API, SSLv3, SSLv2 ClientHello) are used here. Also worth knowing: as of early-to-mid 2026, post-quantum hybrid key exchange (X25519 combined with the NIST-standardized ML-KEM, negotiated as "X25519MLKEM768") has moved from experimental to real deployment — Chrome and Firefox both negotiate it by default when the server supports it — though this project treats it as a fast-moving area to be aware of rather than something to configure by hand, since exact support varies by OpenSSL build.
TLS gives you three specific guarantees for a connection, no more and no less: confidentiality (an eavesdropper can't read the data), integrity (tampering with data in transit is detected), and authentication (you can cryptographically verify you're talking to who you think you're talking to — usually just the server proving its identity to the client, though mutual TLS authenticates both directions). Everything in this project is really just watching those three guarantees get established, in real handshakes, using primitives you've already built by hand in the previous three projects: key exchange, symmetric AEAD encryption, and signatures.
TLS 1.3 (RFC 8446, published 2018) is the current version and the one you should be targeting for anything new. TLS 1.0 and 1.1 were formally deprecated by the IETF in RFC 8996 (March 2021) and have been disabled in every major browser since 2020 — if you find either still enabled on a server you control, that's not a style preference to fix eventually, it's a configuration that fails essentially every current compliance framework (PCI DSS, NIST SP 800-52 Rev. 2) outright.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 7 complete