TLS
Click on the red underlined text to get to the source
... required security measures. SSL, and its successor TLS [RFC2246] were
designed to provide channel-oriented security ...
... The agent acting as the HTTP client should also act as the TLS
client. It should initiate a connection ...
... connection to the server on the
appropriate port and then send the TLS ClientHello to begin the TLS
handshake ...
... initiate the first HTTP request. All HTTP data MUST be sent as TLS
"application data". Normal HTTP ...
... closure alert is received, an implementation can be assured that no
further data will be received on that connection. TLS
implementations MUST initiate an exchange of closure alerts before
closing a connection ...
... closure alerts before
closing a connection. A TLS implementation MAY, after sending a
closure alert, close the connection ...
... security of the data
already received, but simply indicates that subsequent data might
have been truncated. Because TLS is oblivious to HTTP
request/response boundaries, it is necessary to examine the HTTP data
...
... Content-Length header closed before
all data has been read. Because TLS does not provide document
oriented protection, it is impossible to determine whether the
server has miscomputed the Content-Length ...
... A client detecting an incomplete close SHOULD recover gracefully. It
MAY resume a TLS session closed in this fashion.
...
... since the client can often determine when the end of server data is.
Servers SHOULD be willing to resume TLS sessions closed in this
fashion.
...
... HTTP server expects to receive from the client
is the Request-Line production. The first data that a TLS server (and
hence an HTTP/TLS ...
... TLS server (and
hence an HTTP/TLS server) expects to receive is the ClientHello.
Consequently, common practice has been to run HTTP/TLS ...
... TLS server) expects to receive is the ClientHello.
Consequently, common practice has been to run HTTP/TLS over a
separate port in order to distinguish which protocol is being used.
...
... separate port in order to distinguish which protocol is being used.
When HTTP/TLS is being run over a TCP/IP connection, the default port
...
... TLS from being run over another
transport. TLS only presumes a reliable connection-oriented data
stream.
...
... HTML page which was itself obtained
without using HTTP/TLS, a man in the middle could have replaced the
URI ...
... server has such knowledge (typically from some source external to
HTTP or TLS) it SHOULD check the identity as described above.
...