[Post] TLS Deep dive

https://www.feistyduck.com/
https://classes.pracnet.net/courses/practical-tls

### TLS/SSL Overview
- [ ] What is SSL? What is TLS?
- [ ] How do SSL/TLS Protect your Data?
- [ ] Anti-Replay and Non-Repudiation
- [ ] Key Players
- [ ] TLS / SSL Versions - Part 1
- [ ] TLS / SSL Versions - Part 2
- [ ] Module 1 Review Questions

### Cryptography
- [ ] Hashing / Hashing Algorithms
- [ ] Data-Integrity
- [ ] Encryption
- [ ] Public and Private Keys
- [ ] How TLS and SSL use Cryptography
- [ ] Public Key Infrastructure (PKI)
- [ ] Public/Asymmetric Key Encryption
- [ ] Private/Symmetric Key Encryption
- [ ] Types of Certificates
- [ ] Certificate Standards and Encoding Methods
- [ ] Digital Signature
- [ ] Structure of certificate
- [ ] AES
- [ ] Elliptic Curve Cryptography
- [ ] RSA
- [ ] Diffie-Hellman
- [ ] Digital Signature Algorithm
- [ ] Module 2 Review Questions

### x509 Certificates and Keys
- [ ] Overview of the SSL Process
- [ ] What is in a Certificate? (X509 vs RSA Private Key vs Certificate Signing Request (CSR))
- [ ] Inspecting a Certificate
- [ ] Certificate Extensions
- [ ] LAB - Setting up your Lab Environment
- [ ] LAB - Inspecting the certificate of your favorite website
- [ ] What is in a Private Key?
- [ ] LAB - Matching Certificates to Private Keys
- [ ] What is in a CSR?
- [ ] File Formats
- [ ] LAB - Creating a Certificate Authority and two Signed Certificates
- [ ] LAB - File Conversions
- Explain and Convert Certificates and Keys between the three major versions (PEM/DER/PFX)
- [ ] Module 3 Review Questions

### Security through Certificates
- [ ] Overview of the SSL Process, part 2
- [ ] Certificate Validation
- Illustrate what a Client checks to validate a Server’s Certificate
- [ ] Certificate Chains
- Understand the purpose and functional operation of a Certificate Chain
- [ ] LAB - Certificate Chains
- [ ] Certificate Revocation List (CRL)
- [ ] Certificate Signing Request (CSR)
- [ ] Change Cipher Spec
- [ ] Common Name
- [ ] Distinguished Named
- [ ] Domain Validation (DV)
- [ ] End Entity Certificate
- [ ] Ephemeral Key Exchanges
- [ ] Export grade ciphers
- [ ] Extended Validation (EV) Certificate
- [ ] Handshake Messages
- [ ] Intermediate Certificates
- [ ] Issuer
- [ ] Message Signing
- [ ] OCSP Stapling
- [ ] Online Certificate Status Protocol (OCSP)
- [ ] Organization Validation (OV) Certificate
- [ ] Perfect Forward Secrecy
- [ ] Root Certificate
- [ ] Server Name Indication (SNI)
- [ ] SSL Records
- [ ] Subject
- [ ] Subject Alternative Name (SAN) Cert
- [ ] Basic Constraints
- [ ] Certificate Types (DV, OV, EV)
- [ ] Certificate Revocation
- [ ] Checking Revocation Status
- [ ] LAB - Certificate Revocation
- [ ] Module 4 Review Questions

### Cipher Suites
- [ ] Cipher Suites
- Key Exchange
- Forward Secrecy - Key Exchange
- Authentication
- Encryption
- Hashing
- [ ] Cipher Suites - Avoid, Accept, Prefer
- [ ] Enumerating Cipher Suites
- [ ] LAB - Cipher Suite Enumeration

### TLS/SSL Handshake
- [ ] Records - Part 1
- [ ] Records - Part 2
- [ ] TLS Handshake
- [ ] LAB - Inspecting a TLS Handshake in Wireshark
- [ ] Handshake: Ephemeral Diffie-Hellman
- [ ] Handshake: Session Resumption
- [ ] Handshake: Mutual Authentication
- [ ] LAB - Inspecting TLS Handshake Variants
- [ ] TLS Extensions
- [ ] Extension: OCSP Stapling
- [ ] Extension: Server Name Indication (SNI)
- [ ] Extension: Session Tickets
- [ ] LAB - Inspecting Handshake Extensions
- [ ] Decrypting TLS
- [ ] LAB - Decrypting TLS

### TLS Defenses
- [ ] Major SSL/TLS Failures over the Years
- [ ] HTTP Strict Transport Security
- [ ] Certificate Authority Authorization
- [ ] Certificate Transparency
- Overview
- Process and Demonstration
- Merkle Hash Trees

### TLS Attacks & Vulnerabilities
- [ ] Insecure Renegotiation (Session Renegotiation)

### What's new in TLS 1.3
- [ ] Differences with TLS 1.3
- [ ] Changes to Cipher Suites
- [ ] Changes to Handshake
- [ ] Changes to Renegotiation
- [ ] Changes to Session Resumption
- [ ] Middleboxes and Complications with migrating to TLS 1.3
- [ ] Forward Secrecy and TLS 1.3
- [ ] Decrypting TLS 1.3
- [ ] LAB - Capturing and Filtering TLS 1.3 Traffic

### TLS 1.3 Under the Hood
- [ ] Key Schedule
- [ ] Handshake
- [ ] LAB - Inspecting & Decrypting a TLS 1.3 Handshake
- [ ] Session Resumption
- [ ] PSK Mode Handshake
- [ ] Session Tickets
- [ ] 0-RTT Handshake
- [ ] LAB - Inspecting TLS 1.3 PSK Handshakes
- [ ] Mutual Authentication
- [ ] Safety improvements
- Removals
- Optimizations and Enhancements
- [ ] Performance improvements
- 1-RTT
- 0-RTT
- [ ] Deployment

### TLS 1.3 Extensions
- [ ] Extensions Overview
- [ ] Review of TLS 1.3 Extensions already discussed
- [ ] Signature Algorithm & Signature Algorithm Certificate
- [ ] Cookies
- [ ] ALPN - Application Layer Protocol Negotiation
- [ ] PHA - Post Handshake Authentication

- What is Trust Store / Cert Store
- Managing Trust Store
- Intermediate CAs
- Verifying Chain of Trust
- OpenSSL

- Certificate Provisioning
- Request & Signing
- Security - Request & Signing
- Installation
- Installation Security
- Revocation
- SSL errors
- SIGMAC Compiler
- AES-GCM