Skip to content

🧰 Stage 5: Troubleshooting and Advanced Topics

🎯 Learning Objectives

By the end of this stage, you will be able to: 1. Systematically troubleshoot HTTPS connection problems. 1. Decode and interpret handshake or negotiation failures. 1. Identify performance issues in HTTP/2 (latency, head-of-line blocking, flow control). 1. Correlate TLS errors with certificate and cipher configurations. 1. Explain the full HTTPS transaction, packet-by-packet, from client to server.

📆 Suggested Duration

1–2 weeks (10–12 hours total) - 4 h theory - 6–8 h hands-on diagnostics

📘 Section 1: Troubleshooting Methodology

🧠 Concepts to Learn

Always move from Layer 1 upward:

1️⃣ Network (IP reachability) 2️⃣ TCP (connection handshake) 3️⃣ TLS (security handshake) 4️⃣ HTTP/2 (application framing)

🧩 Flow

  1. Check reachability (ping, traceroute).
  2. Check TCP connectivity (nc host 443).
  3. Check TLS handshake (openssl s_client).
  4. Check HTTP protocol (curl -v --http2).
  5. Use Wireshark for packet-level inspection.

📘 Section 2: TLS Handshake Failures

🧠 Common Errors and Causes

Error Likely Root Cause Command to Diagnose
handshake failure Cipher/version mismatch openssl s_client -connect host:443 -tls1_2
certificate expired Out-of-date cert openssl x509 -enddate -in cert.pem -noout
hostname mismatch Wrong SAN openssl s_client -connect host:443 -servername wrong
unknown CA Missing intermediate openssl verify -CAfile chain.pem server.crt
alert: bad record mac Data corruption or key mismatch Wireshark → TLS alert

🧪 Lab 1 – Simulate TLS Errors

  1. Run a local HTTPS server with a self-signed cert: 
    1
    python3 -m http.server 8443 --bind 0.0.0.0 --directory . --ssl-cert cert.pem --ssl-key key.pem
  2. Connect without trusting the CA: 
    1
    curl -v https://localhost:8443

→ You’ll see certificate verify failed.

  1. Then trust the CA with --cacert and retry to verify resolution.

📘 Section 3: HTTP/2 Connection and Negotiation Failures

🧠 Possible Causes

  • Server doesn’t advertise ALPN: h2.
  • Proxy/firewall strips ALPN or downgrades connection.
  • Client forces HTTP/1.1.
  • Misconfigured TLS cipher (HTTP/2 forbids some).

🧪 Lab 2 – Analyze ALPN

1
openssl s_client -connect www.google.com:443 -alpn h2

→ Look for: 

1
ALPN protocol: h2

If missing, the server or intermediary is disabling HTTP/2.

🧩 Tip

HTTP/2 requires TLS 1.2+, and certain ciphers (e.g., no CBC).

📘 Section 4: Performance Analysis

🧠 Common Symptoms

Symptom Likely
High latency before first byte Slow DNS, TCP handshake, or TLS handshake
Connection resets MTU issues, firewall, or timeout
Slow page load despite low latency HTTP/1.1 fallback, poor parallelism
Uneven performance Window size misconfiguration, flow-control stalls

🧪 Lab 3 – Measure Timing

Use curl to measure connection phases: 

1
curl -w "DNS: %{time_namelookup}s\nConnect: %{time_connect}s\nTLS: %{time_appconnect}s\nStartTransfer: %{time_starttransfer}s\nTotal: %{time_total}s\n" -o /dev/null -s https://www.google.com

Compare with and without --http2.

→ You’ll see reduced total time with HTTP/2 due to multiplexing.

📘 Section 5: Wireshark End-to-End Analysis

🧪 Lab 4 – Full HTTPS Capture

  1. Start Wireshark, filter: 
    1
    tcp.port == 443
  2. Visit https://example.com.
  3. Identify:
  4. DNS request/response (UDP 53).
  5. TCP handshake (SYN, SYN/ACK, ACK).
  6. TLS handshake (ClientHello → ServerHello).
  7. ALPN: h2 negotiation.

  8. HTTP/2 frames (SETTINGS, HEADERS, DATA).

  9. Export TLS session keys from the browser (if supported) to decrypt HTTPS and see HTTP/2 frames decoded.

Example (Firefox/Chrome): 

1
export SSLKEYLOGFILE=/tmp/sslkeys.log

Load /tmp/sslkeys.log in Wireshark Preferences → TLS → (Pre-Master-Secret log file). → You can now view plaintext HTTP/2 headers.

📘 Section 6: Certificate Chain and Trust Validation

🧠 Concepts

  • The client must build a chain: Server → Intermediate → Root.
  • Failure at any link = validation error.
  • Browsers maintain trusted root store; CLI tools use system store.

🧪 Lab 5 – Chain Inspection

1
openssl s_client -connect example.com:443 -showcerts

→ Observe all certificates returned by the server. Then verify: 

1
openssl verify -CAfile <(cat intermediate.crt rootCA.crt) server.crt

📘 Section 7: Mixed Content and Redirect Issues

🧠 Concepts

  • HTTPS pages loading HTTP subresources → blocked by browsers.
  • HTTP → HTTPS redirects might cause extra round trips.

🧪 Lab 6 – Follow Redirect Chains

1
curl -v -L http://github.com

→ Observe 301 redirect to https://github.com. Capture the same in Wireshark to count the number of TLS handshakes.

📘 Section 8: Advanced Tools

Tool Purpose
curl Quick diagnostics (-v, --http2, --resolve, --trace-time)
openssl TLS verification, cert chain, ALPN
ssllabs.com/ssltest Public site TLS analysis
testssl.sh Local script for cipher/protocol audit
nghttp / h2load HTTP/2 client testing and benchmarking
Wireshark Packet-level analysis and decryption

📘 Section 9: Common Troubleshooting Scenarios

Scenario Diagnostic Steps Tools
Site unreachable Check IP, DNS ping, dig
TCP connect fails Port closed/firewall nc host 443
TLS fails Wrong cipher, expired cert openssl s_client
HTTP/2 fallback ALPN missing curl -v
Slow page load Multiple connections or poor reuse h2load, Wireshark
“Unknown CA” Chain incomplete openssl verify

📘 Section 10: Explain and Document

🧩 Task

Write a complete flow explanation:

“What happens when you access https://example.com with HTTP/2.”

Include:

  1. DNS lookup
  2. TCP handshake
  3. TLS negotiation (ALPN = h2)
  4. HTTP/2 streams (HEADERS → DATA → END_STREAM)
  5. Connection close

Then, describe one failure scenario and the diagnostic steps you would take to resolve it.

🧠 Knowledge Check

  1. What is the sequence of layers to check when HTTPS fails?
  2. How does ALPN affect protocol selection?
  3. What is the difference between a cipher mismatch and a certificate error?
  4. How can you decrypt HTTPS traffic in Wireshark for analysis?
  5. What tools help you test HTTP/2 performance?

🏁 Stage 5 Completion Outcome

You should now be able to: ✅ Systematically troubleshoot HTTPS/TLS/HTTP/2 issues from the network up. ✅ Explain the full lifecycle of an HTTP/2 over TLS connection. ✅ Use Wireshark, curl, and openssl to diagnose handshake and ALPN problems. ✅ Interpret timing metrics and optimize web performance. ✅ Document and teach the protocol flow clearly to others.