TLS dhe Roli i Tij

TLS (Transport Layer Security) is the protocol that encrypts almost all web traffic today and is the successor to the deprecated SSL family.

TLS has two main jobs: confidentiality (encrypt the traffic so an eavesdropper cannot read it) and authenticity (verify that the server you are talking to is actually the one you intended). The first is provided by symmetric encryption (AES-GCM, ChaCha20-Poly1305) using a session key; the second is provided by X.509 certificates issued by certificate authorities trusted by the client. A TLS handshake begins with the client sending a ClientHello containing the cipher suites it supports and a random value. The server replies with its certificate, chosen cipher suite and its own random. Both sides then derive a shared session key using a key-exchange algorithm — historically RSA, now overwhelmingly ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) because it provides forward secrecy: a future compromise of the server's private key cannot decrypt past recorded traffic. TLS 1.3 (RFC 8446) is the current version and removes legacy insecure options like static RSA key exchange, CBC mode ciphers and compression. Modern servers should support only TLS 1.2 and 1.3 and prefer AEAD cipher suites. Tools like testssl.sh and Qualys SSL Labs let you quickly audit any public endpoint.

Mjete për TLS:

• openssl s_client — inspekton certifikata dhe handshake.
• testssl.sh — skaner i plotë TLS.
• SSLLabs (Qualys) — raport online.
• mitmproxy — për debugging në lab.

Inspektim i handshake-ut TLS:

openssl s_client -connect example.com:443 -servername example.com -showcerts
testssl.sh --severity HIGH https://example.com

Gjeneron çertifikatë self-signed për lab:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=lab.test"

1. Skano 3 sajte publike me testssl.sh dhe shkruaj tre dobësi të gjetura.
2. Krahaso ciphersuite-et e ofruara nga TLS 1.2 kundrejt TLS 1.3.

• RFC 8446 — TLS 1.3.
• Mozilla SSL Configuration Generator.
• Qualys SSL Labs Best Practices.