TLS

What is TLS?

TLS (Transport Layer Security) is a cryptographic protocol designed to provide communications security over a computer network. It is the successor to SSL (Secure Sockets Layer) and is widely used to secure web traffic (HTTPS), email, instant messaging, and VoIP.

TLS Versions

How TLS Works

1. Client Hello — client sends supported TLS versions, cipher suites, and a random number
2. Server Hello — server selects TLS version and cipher suite, sends certificate
3. Key Exchange — secure key material is generated (ECDHE, DHE, or RSA)
4. Encrypted Communication — all data is encrypted using the negotiated symmetric key

TLS 1.3 simplifies this to a 1-RTT handshake (or even 0-RTT for resumption), making it significantly faster than previous versions.

TLS Certificate Fields

TLS in Zondex

Zondex indexes TLS certificate information including:

• Certificate issuer and subject — who issued it and for whom
• Validity dates — expiration tracking
• Key algorithms and sizes — cryptographic strength
• JARM fingerprints — TLS server fingerprinting
• Subject Alternative Names (SANs) — all domains on a certificate

Search on Zondex

Use TLS-related filters to search:

• tls:true — find all hosts with TLS enabled
• tls:false port:443 — find HTTPS ports without TLS (misconfiguration)
• tag:self-signed — find self-signed certificates
• ssl.issuer:"Let's Encrypt" — find certs from a specific CA
• tag:expired-cert — find expired certificates