Production TLS Concerns

Real TLS deployments face many concerns beyond the protocol:

Certificate management:

• Auto-renewal via Let's Encrypt + ACME (most modern setups).
• Wildcard certs vs SAN entries.
• Pinning (HPKP deprecated; CT logs replaced it).

Cipher suite selection:

• Modern Mozilla configs: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 only.
• Drop TLS 1.0/1.1 entirely. Drop ciphers without forward secrecy.

Performance:

• Session resumption + 0-RTT for repeat clients.
• TLS termination on load balancer (saves CPU on app servers).
• HTTP/2 with ALPN negotiation (faster than HTTP/1.1 over TLS).
• HTTP/3 over QUIC over UDP — TLS handshake fused with transport handshake.

Privacy:

• Encrypted Client Hello (ECH) — hides SNI from network observers (a 2024+ feature).
• DNS-over-HTTPS to keep DNS queries off the network.

Compliance:

• FIPS 140-2/3 mode in regulated industries (US gov, banking).
• TLS 1.3 + AES-256-GCM is FIPS-compliant since ~2020.

Attacks to know:

• CRIME / BREACH: compression-based plaintext recovery (don't compress mixed plaintext/secret).
• Heartbleed (2014): OpenSSL OOB read in heartbeat extension. Massive cleanup.
• ROBOT (2017): RSA padding oracle in TLS 1.2. TLS 1.3 dropped RSA key exchange.
• Lucky 13 (2013): timing attack on CBC + HMAC. AEAD avoids this.
• Bleichenbacher (1998, still recurring): RSA PKCS#1 v1.5 padding oracle.

Use battle-tested implementations: OpenSSL, BoringSSL, rustls. NEVER roll your own TLS in production.

Our toy stack is a learning tool. The real protocol's security depends on careful, paranoid implementation across thousands of edge cases.