Skip to main content

RFC 2818 - Practical Examples

Practical Examples​

Complete HTTPS Connection​

Client Operations:

1. Parse URI: https://www.example.com/page.html
   → Hostname: www.example.com
   → Port: 443 (default)

2. TCP connect to www.example.com:443

3. TLS Handshake:
   ClientHello →
   ← ServerHello + Certificate
   Verify hostname in certificate
   ...handshake complete...

4. Send encrypted HTTP request:
   GET /page.html HTTP/1.1
   Host: www.example.com

5. Receive encrypted HTTP response:
   HTTP/1.1 200 OK
   Content-Length: 1234
   ...

6. Close connection:
   Send closure_alert
   Close TCP connection

Certificate Verification Example​

# Python example (conceptual)
import ssl
import socket

# Create SSL context
context = ssl.create_default_context()

# Connect to server
sock = socket.create_connection(('www.example.com', 443))
ssock = context.wrap_socket(sock, server_hostname='www.example.com')

# wrap_socket automatically verifies:
# 1. Certificate chain is valid
# 2. Hostname matches
# 3. Certificate not expired

# Get certificate information
cert = ssock.getpeercert()
print(f"Subject: {cert['subject']}")
print(f"Issuer: {cert['issuer']}")
print(f"SANs: {cert.get('subjectAltName', [])}")

Certificate Verification Example​

Error 1: Certificate Hostname Mismatch
Certificate Hostname Mismatch
- Certificate: *.example.com
- Accessing: www.different.com
→ Terminate connection or warn user

Error 2: Certificate Expired
Certificate Expired
- Not After: 2023-12-31
- Current: 2024-01-01
→ Refuse connection

Error 3: Self-Signed Certificate
Self-Signed Certificate
- Not in trusted CA list
→ Warn user or refuse

Error 4: Incomplete Certificate Chain
Incomplete Certificate Chain
- Missing intermediate certificate
→ Cannot verify, refuse connection