Unit 3.3 · about 3 h
251 / 324TLS and HTTP versions
The RPCs in this section run over TLS and HTTP. Misattributing a TLS failure to the application wastes every later debugging step, and version choice decides connection reuse.
- explain
You can now
- Explain what TLS authenticates, what it encrypts, and what stays visible on the wire.
- Read a TLS 1.3 handshake through
ClientHello, certificate,CertificateVerify,Finishedand ALPN. - Contrast the HTTP/1.1, HTTP/2 and HTTP/3 wire mappings and state which head-of-line blocking each removes.
Covers
- TLS identity, confidentiality and integrity vocabulary
- HTTP request-response and connection reuse vocabulary
- HTTP/2, HTTP/3 and QUIC vocabulary
Study, in this order
4 steps
- TLS handshake step by stepAlgoMaster Networks - pcap and concurrent server labs
Step 1
ClientHellothrough Step 8Finished; TLS Messages, Records, and TCP Segments; A Worked Handshake TraceDepth · Skip Session Resumption and 0-RTT detail on first pass; return for the replay warning before the idempotency unit.
- Inspecting and diagnosing TLSAlgoMaster Networks - pcap and concurrent server labs
Inspecting a Real Handshake (
s_client, curl timing); Diagnosing Handshake Failures (phase order); Operating and Measuring TLSDepth · Run the
s_clientandcurlcommands yourself; treat the metric list as vocabulary. - HTTP versions comparedAlgoMaster Networks - pcap and concurrent server labs
One Set of Semantics; HTTP/1.1 text messages; HTTP/2 multiplexed streams; HTTP/3 over QUIC; Three Forms of Head-of-Line Blocking; How a Client Selects a Version
- Minimal HTTP exchange vocabularyBeej's Guide to Network Concepts - TCP and UDP path
Chapter 5, Section 5.3 (HTTP Summary) only
Depth · Read Section 5.3 only. The chapter 5 client and server projects belong to the sockets and HTTP practice in later units.
Focus on
ServerHelloproves nothing about identity. Authentication is the certificate chain plusCertificateVerifyplusFinishedchecked against the handshake transcript.- TLS 1.3 with ephemeral keys gives forward secrecy: a stolen long-term key does not decrypt recorded sessions.
- ALPN negotiates the application protocol inside TLS. A compatible handshake can still fail with
no_application_protocol. - The HTTP versions share semantics and differ on the wire: ordered text messages, multiplexed streams over one TCP connection, streams over QUIC. HTTP/2 removes HTTP-level head-of-line blocking but keeps TCP's; HTTP/3 keeps it only within one stream.
Reproduce closed-book
curl -w with time_namelookup, time_connect, time_appconnect, time_starttransfer and http_version against https://example.com/ three times, and note your curl and TLS library versions and whether DNS was warm. State which interval is DNS, which is TCP, which adds TLS, and why three requests from one place cannot characterize the service.Traps
- Believing the certificate encrypts the data. Ephemeral key exchange protects records; the certificate only authenticates.
- Expecting TLS to hide everything. Server name, record sizes and timing stay visible; that is why session key logs are secrets.
- Calling HTTP/3 faster by definition. It removes TCP head-of-line blocking and can resume faster; path, server and loss still decide.
Practice
Beej's Network Concepts: Project HTTP Client and Server
Chapter 5, Sections 5.1 to 5.5: build the client against a local server; Section 5.6 hints for partial data and status codes
Keep the server on loopback; the point is a correct request-response exchange, not deployment.
Self-test
-
A capture shows
ClientHello,ServerHello, then opaque records. Can you read the HTTP path?No. Everything afterServerHellois encrypted in TLS 1.3. Endpoints, ports, timing and sizes remain; the path needs endpoint logs or key material. -
time_appconnectminustime_connectis 25 ms. What does that interval contain?Roughly the TLS handshake after TCP connected: certificate, key exchange andFinishedplus their round trips. It is cumulative and approximate. -
Which head-of-line blocking does HTTP/2 keep?
TCP-level blocking. One lost TCP segment stalls every multiplexed stream on that connection; HTTP/3 moves recovery to per-stream QUIC. -
The server presents a valid certificate for another hostname. Does the handshake succeed?
No for a correct client. Every signature can verify, but the name check fails, so the client aborts with a certificate alert instead of sending application data.
Completion criterion
Stop when
You sort a failed HTTPS request into before-TLS, negotiation, identity, client-auth or ALPN phases, and can say which HTTP version fits a new endpoint and why.
Mark passed, then open 3.4 Only mark this when you can do it without notes.Leads to
- 3.5 RPC schemas, versions, errors and trace context Run RPC contracts over the TLS and HTTP substrate.
- 3.7 Connection shutdown, pools and latency decomposition Turn handshake cost into reuse and pool policy.
Comes after
- 3.1 Network layers, addressing, routing and DNSSee what TLS and HTTP add above the addressed transport path.
Resources for this unit
- Beej's Guide to Network Concepts - TCP and UDP path Read the OS and sockets, protocol layering, IP, UDP and TCP chapters alongside packet captures from your own client and server. Use it to explain transport behavior rather than memorize layer names.
- AlgoMaster Networks - pcap and concurrent server labs Use Reading a Packet Capture: A Real Bug and Building a Concurrent TCP Echo Server after the Beej implementation. Reproduce one packet-level observation and one admission, deadline or shutdown behavior in your independently written service.
Also in this section
- Beej's Guide to Network Programming - sockets to multiplexing Read What is a socket?, IP addresses and data structures, Client-server background, System calls or bust, Client-server examples, Slightly advanced techniques and sendall. Build the simple TCP pair first, then replace delimiter assumptions with a bounded length-prefixed protocol.
- MIT 6.5840 - RPC, threads and fault vocabulary Read the introductory RPC and threads material plus the lab guidance. Use it to enumerate timeout ambiguity and duplicate effects. Stop before Raft and the full lab sequence.
- Replicated Log and Stream Processor - protocol slice Use only the protocol requirements, deterministic network fault matrix and delivery-contract questions. Build the single-node framed service now; keep replication and consensus for the later project.
- Designing Data-Intensive Applications, 2nd edition - Chapter 5 Read Formats for Encoding Data (printed pp. 163 to 177) for schema merits and compatibility, and Dataflow Through Services: REST and RPC (printed pp. 180 to 186) for service dataflow, version coexistence and the idempotence pointer.
- gRPC Deadlines guide Read Overview, Deadlines on the Client and Deadline Propagation for absolute deadlines, remaining-time forwarding and clock-skew shielding.
- gRPC Status Codes Read the full status list, including
DEADLINE_EXCEEDED,UNAVAILABLEand the codes never generated by the library, for the error taxonomy. - W3C Trace Context Read Section 3.2 for the
traceparentformat and Sections 3.4 to 3.5 for the legaltraceparentandtracestatemutations when forwarding.