Skip to content

Understand and troubleshoot HTTP/2 and TLS protocols end-to-end

🧩 Stage 1 – Foundations: Internet, TCP/IP, and HTTPS Concepts

🎯 Objectives

  • Review the fundamentals HTTP builds upon.
  • Understand the layers beneath TLS (TCP/IP).
  • Learn how HTTPS fits in the overall communication stack.

πŸ“š Topics

  • TCP 3-way handshake, retransmissions, congestion control
  • DNS resolution
  • HTTP vs HTTPS
  • Ports 80 and 443
  • Role of TLS in securing HTTP

πŸ§ͺ Lab Exercises

  • Use curl -v http://example.com and curl -v https://example.com to compare.
  • Capture packets with tcpdump or Wireshark during both sessions.
  • Identify TCP handshakes, TLS negotiation, and data exchange.

πŸ” Stage 2 – Understanding TLS (Transport Layer Security)

🎯 Objectives

  • Learn what TLS does (encryption, authentication, integrity).
  • Understand the TLS handshake step by step.
  • Differentiate between TLS 1.2 and TLS 1.3.
  • Explore certificates, CA chains, and ciphersuites.

πŸ“š Topics

  • Public Key Infrastructure (Root, Intermediate, Server certs)
  • Certificate signing and verification
  • TLS handshake message flow
  • Cipher suites: key exchange, authentication, encryption, MAC
  • Session resumption and 0-RTT in TLS 1.3

πŸ§ͺ Labs

  1. Generate certificates with OpenSSL:
1
2
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt

Then issue an intermediate and server cert.

  1. Run a local HTTPS web server using your certs (e.g., nginx or Python http.server --ssl).
  2. Capture and analyze TLS handshake with Wireshark or openssl s_client -connect.
  3. Compare TLS versions:
1
2
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3

🌐 Stage 3 – Understanding HTTP/1.1

🎯 Objectives

  • Learn how HTTP works before jumping into HTTP/2.
  • Understand headers, methods, cookies, and persistent connections.

πŸ“š Topics

  • Request/Response model
  • HTTP methods (GET, POST, PUT, DELETE)
  • Headers and status codes
  • Keep-Alive and pipelining

πŸ§ͺ Labs

  • Use curl -v -H "Connection: close" vs Connection: keep-alive
  • Capture with Wireshark to see multiple HTTP requests on the same TCP connection.

βš™οΈ Stage 4 – Deep Dive into HTTP/2

🎯 Objectives

  • Understand what changed from HTTP/1.1.
  • Learn about binary framing, multiplexing, and header compression.
  • Recognize the interaction between HTTP/2 and TLS (ALPN).

πŸ“š Topics

  • HTTP/2 binary framing layer
  • Streams, frames, and flow control
  • HPACK header compression
  • Server push
  • ALPN (Application-Layer Protocol Negotiation)

πŸ§ͺ Labs

  1. Inspect HTTP/2 negotiation:
1
2
curl -v --http2 https://www.google.com
curl -v --http1.1 https://www.google.com

β†’ Compare ALPN negotiation and headers.

  1. Capture HTTP/2 traffic with Wireshark (filter: tcp.port==443 && http2).

  2. Use nghttp (HTTP/2 client) to view frame-level behavior:

1
nghttp -nv https://nghttp2.org

🧰 Stage 5 – Troubleshooting and Advanced Topics

🎯 Objectives

  • Learn how to identify TLS/HTTP/2 issues in the field.
  • Understand performance bottlenecks, misconfigurations, and certificate issues.

πŸ“š Topics

  • Common TLS errors (expired certs, SNI issues, mismatched domains, cipher mismatches)
  • HTTP/2 issues (stream resets, priority, flow control)
  • Performance tuning (TLS session resumption, ALPN delays)

πŸ§ͺ Labs

  • Simulate a broken certificate chain and test browser/curl behavior.
  • Use ssllabs.com/ssltest/ on your test site.
  • Capture failed TLS sessions and analyze where the handshake fails.
  • Enable HTTP/3 on a test server and see negotiation fallback.

πŸ“– Stage 6 – Explain and Document

🎯 Objectives

  • Be able to explain HTTP/2 + TLS to others.
  • Document the packet-level flow of a TLS handshake and an HTTP/2 exchange.

πŸ“š Tasks

  • Write a step-by-step document:
  • β€œWhat happens when you type https://example.com in a browser.”

  • Include DNS β†’ TCP β†’ TLS β†’ HTTP/2 β†’ response.

  • Prepare troubleshooting checklists for:

  • TLS handshake failure
  • HTTP/2 negotiation issue
  • Performance degradation
  • Wireshark (packet analysis)
  • curl (--http1.1, --http2, --verbose, --insecure, --trace-ascii)
  • openssl (s_client, x509, req)
  • nghttp / nghttpd (HTTP/2 client/server)
  • nginx or Apache (for HTTP/2 and TLS testing)
  • ssllabs.com and testssl.sh (for TLS configuration testing)

πŸ“˜ Suggested Resources