---
tags: [计算机网络, HTTPS, TLS, 证书, PKI]
create time: 2026-05-18 03:00
---

# HTTPS 与 TLS 握手

## 概述

HTTPS = HTTP over TLS（Transport Layer Security）。TLS 在 TCP 和应用层之间插入一个加密通道，确保通信的机密性、完整性和对端身份验证。理解 TLS 握手过程是排查 SSL 错误的核心能力。

## TLS 在协议栈中的位置

```
┌─────────────┐
│    HTTP     │  ← 应用层
├─────────────┤
│     TLS     │  ← "加密壳" — 透明包装下层数据
├─────────────┤
│     TCP     │  ← 可靠传输
├─────────────┤
│     IP      │  ← 路由
└─────────────┘
```

## TLS 握手流程（TLS 1.3）

### 完整交互序列

```mermaid
sequenceDiagram
    participant C as Client
    participant S as Server
    
    Note over C,S: Phase 1: Key Exchange (Full Handshake)
    C->>S: ClientHello<br/>• TLS version (1.3)<br/>• Cipher suites (pref order)<br/>• Random bytes<br/>• PSK/session ticket (optional)<br/>• Extensions (ALPN, SNI...)
    
    S-->>C: ServerHello<br/>• Selected cipher suite<br/>• Random bytes<br/>• Server's key share (ephemeral ECDHE)
    
    S->>S: Send certificate + cert_chain
    S->>C: CertificateRequest (optional)
    S->>C: ServerKeyExchange (if needed)
    S->>C: ServerFinished
    
    C->>C: Verify cert chain → CA ✓
    C->>S: ClientKeyExchange (key share)
    C->>C: Compute shared secret (ECDHE)
    C->>S: ChangeCipherSpec (implicit in 1.3)
    C->>S: ClientFinished
    
    Note over C,S: ← Encryption Enabled ✨ -->
    
    C->>S: Application data (HTTP Request) 🔒
    S->>C: Application data (HTTP Response) 🔒
```

### TLS 1.3 vs TLS 1.2 对比

| 特性 | TLS 1.2 | TLS 1.3 |
|------|---------|---------|
| **往返次数** | 2 RTT (或 1 RTT with session resumption) | **1 RTT** (0 RTT if resumed) ⚡ |
| 密钥交换 | RSA / DHE / ECDHE | **仅 ECDHE** (前向安全强制) |
| Cipher Suites | ~30+ 种选择 | **仅 4 种** (AES-GCM, ChaCha20-Poly1305) |
| 压缩 | ✅ (导致 CRIME 漏洞) | ❌ **已禁用** |
| 重协商 | ✅ | ❌ (改用 NewSession Ticket) |
| 静态 RSA 密钥交换 | ✅ | ❌ **已移除** |
| CBC 模式密文 | ✅ | ❌ **已移除** |
| Export ciphers | ✅ | ❌ **已移除** |
| Renegotiation | ✅ | ❌ (用 renegotiation_info 扩展替代) |

> [!tip] TLS 1.3 为什么更快？
> TLS 1.2: ClientHello → ServerHello → Certificate → ServerKeyExchange → ... → ClientKeyExchange → Finished = **2 full RTTs**
> 
> TLS 1.3: ClientHello (含 client key share) → ServerHello (含 server key share) + Certificate + Finished = **1 RTT**
>
> 因为客户端在第一个包中就携带了自己的密钥共享信息，无需等待服务器回复后再计算。

## Cipher Suite 详解

TLS 1.3 只有 4 个 Cipher Suites：

| 编号 | Cipher Suite | KEM | AEAD | HKDF |
|------|-------------|-----|------|------|
| TLS_AES_128_GCM_SHA256 | AES-128-GCM | X25519 | AES-128-GCM | SHA256 |
| TLS_AES_256_GCM_SHA384 | AES-256-GCM | X25519 | AES-256-GCM | SHA384 |
| TLS_CHACHA20_POLY1305_SHA256 | ChaCha20-Poly1305 | X25519 | ChaCha20-Poly1305 | SHA256 |
| TLS_AES_128_CCM_SHA256 | AES-128-CCM | X25519 | AES-128-CCM | SHA256 |

**Go 中默认偏好顺序：** `TLS_AES_256_GCM_SHA384 > TLS_AES_128_GCM_SHA256 > TLS_CHACHA20_POLY1305_SHA256`

## 证书链验证流程

```mermaid
flowchart TD
    Cert["Server Certificate<br/>CN = example.com"] -->|"issued by"| Inter["Intermediate CA<br/>ISRG Root X1"]
    Inter -->|"issued by"| Root["Root CA<br/>DigiCert Global Root G2"]
    Root -->|"self-signed"| Root
    
    Client["Client 浏览器"] -->|"验证:"| V1["1. 签名是否由上层CA签发?"]
    V1 -->|"是"| V2["2. CN/SAN 是否匹配域名?"]
    V2 -->|"是"| V3["3. 是否过期?"]
    V3 -->|"是"| V4["4. 是否在 OCSP/CRL 吊销列表中?"]
    V4 -->|"是"| V5["5. 根证书是否在信任库中?"]
    V5 -->|"是"| TRUSTED["✅ 信任!"]
    
    style TRUSTED fill:#98FB98,color:#000
```

## 实际调试命令

```bash
# 查看服务器支持的 TLS 版本和 Cipher Suites
$ openssl s_client -connect example.com:443 -tls1_3
CONNECTED(00000003)
Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
Certificate chain:
 0 s:CN = example.com
   i:C = US, O = DigiCert Inc, CN = DigiCert TLS Hybrid ECC_SHA384 2020 CA1

# 指定特定 Cipher 测试
$ openssl s_client -connect example.com:443 \
    -cipher 'ECDHE-ECDSA-AES256-GCM-SHA384'

# 获取证书信息
$ openssl x509 -in cert.pem -noout -dates -subject -issuer
  subject=CN = example.com
  notBefore=Jan  1 00:00:00 2025 GMT
  notAfter=Jan  1 00:00:00 2026 GMT

# 检查 OCSP 状态
$ curl -vI https://example.com
  < HTTP/2 200
  < alt-s: h3=":443"; ma=86400
  < alt-s: h2=":443"; ma=86400

# Go 中自定义证书验证
import "crypto/tls"
config := &tls.Config{
    InsecureSkipVerify: false,  // 生产环境永远为 false
    MinVersion:         tls.VersionTLS13,
}
conn, _ := tls.Dial("tcp", "example.com:443", config)
```

## Go 标准库中的 TLS

```go
// 创建安全的 TLS 配置
var DefaultTLSConfig = tls.Config{
    MinVersion: tls.VersionTLS12, // 最低支持 TLS 1.2
    PreferServerCipherSuites: true,
}

// http.Server 自动启用 TLS
srv := &http.Server{
    Addr:    ":443",
    Handler: handler,
    TLSConfig: &tls.Config{
        MinVersion: tls.VersionTLS13,
        NextProtos: []string{"h2", "http/1.1"}, // ALPN
    },
}
srv.ListenAndServeTLS("cert.pem", "key.pem")

// 或 Let's Encrypt (auto TLS)
import "crypto/tls"
mux.HandleFunc("/", handler)
go http.ListenAndServe(":80", nil) // ACME Challenge
go http.ListenAndServeTLS(":443", "", "", &http.Server{
    Handler: mux,
    TLSConfig: &tls.Config{
        GetCertificate: autoTLSManager.GetCertificate,
        NextProtos:     []string{"h2", "http/1.1"},
    },
})
```

## 关联笔记

- [[hhs/NETWORK/HTTP/3与QUIC]] — QUIC 内置 TLS 1.3
- [[hhs/NETWORK/DNS原理与优化]] — SNI 扩展帮助 DNS 和 CDN 调度
- [[hhs/NETWORK/SSL Strip-Heartbleed]] — TLS 历史安全漏洞