TLS / рукопожатие: пример кода

Question

Accepted Answer

## Пример

TLS обрабатывает browser/OS; front-end engineers *наблюдают* и *конфигурируют*:

```bash
# Inspect the negotiated version, cipher, and cert chain
openssl s_client -connect example.com:443 -servername example.com -tls1_3 /dev/null \
  | openssl x509 -noout -dates -subject
```

```
# Header that opts a whole domain into HTTPS-only for a year, preventing
# SSL-strip downgrade attacks. Add to preload lists for first-visit protection.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```

## Итог

Проверяйте cert chain openssl'ом; HSTS + preload — defense against downgrade на first visits после preload.