https://souljian.cn/tags/tls/Recent content in TLS on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088118/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088118/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>本文讲 HTTP/HTTPS 原理，不涉及攻击利用。</p> <h2 id="一http-vs-https">一、HTTP vs HTTPS </h2><img src="https://souljian.cn/img/http-https-flow.svg" alt="HTTP/HTTPS 工作原理" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">HTTP：明文传输 → 抓包即看到所有数据 </span></span><span class="line"><span class="cl">HTTPS = HTTP + TLS → 加密传输 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二tls-13-握手流程">二、TLS 1.3 握手流程 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① ClientHello: 支持的密码套件 </span></span><span class="line"><span class="cl">② ServerHello: 选择的密码套件 </span></span><span class="line"><span class="cl">③ Server 证书 + 密钥交换 </span></span><span class="line"><span class="cl">④ Client 验证证书 → 生成密钥 </span></span><span class="line"><span class="cl">⑤ Finished → 加密通信开始 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三证书验证">三、证书验证 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 证书有效期 </span></span><span class="line"><span class="cl">② 颁发机构（CA）是否可信 </span></span><span class="line"><span class="cl">③ 域名是否匹配 </span></span><span class="line"><span class="cl">④ 证书链是否完整 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四抓包工具">四、抓包工具 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Wireshark：抓包 + 逐层分析 </span></span><span class="line"><span class="cl">Fiddler：HTTP/HTTPS 代理 + 解密 </span></span><span class="line"><span class="cl">Charles：同 Fiddler，跨平台 </span></span><span class="line"><span class="cl">Burp Suite：HTTP 拦截 + 修改 + 重放 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>理解 TLS 握手才能理解 HTTPS 的安全边界。抓包工具是 Web 安全测试的基础。</p>