1. ClientHello: Client sends supported versions, ciphers
2. ServerHello: Server selects version, cipher
3. Certificate: Server sends certificate
4. ServerKeyExchange: Server sends key exchange params
5. ServerHelloDone: Server done
6. ClientKeyExchange: Client sends key exchange params
7. ChangeCipherSpec: Switch to encryption
8. Finished: Verification message

# Generate self-signed certificate
openssl req -x509 -newkey rsa:4096 -keyout key.pem \
  -out cert.pem -days 365 -nodes

# View certificate
openssl x509 -in cert.pem -text -noout

# Check certificate validity
openssl x509 -in cert.pem -noout -dates

# Combine cert and key
cat cert.pem key.pem > combined.pem

# Generate private key
openssl genrsa -out private.key 2048

# Generate CSR (Certificate Signing Request)
openssl req -new -key private.key -out request.csr

# Check certificate
openssl x509 -in certificate.crt -text -noout

# Verify certificate chain
openssl verify -CAfile ca.crt certificate.crt

# Test HTTPS connection
openssl s_client -connect example.com:443

# HTTPS request
curl https://example.com

# Ignore certificate verification (NOT recommended)
curl -k https://example.com

# Show certificate info
curl -v https://example.com

# Use specific certificate
curl --cert client.crt --key client.key https://example.com

server {
    listen 443 ssl http2;
    server_name example.com;

    # Certificate files
    ssl_certificate /etc/ssl/certs/cert.pem;
    ssl_certificate_key /etc/ssl/private/key.pem;

    # TLS version
    ssl_protocols TLSv1.2 TLSv1.3;

    # Ciphers
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000" always;
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

# Install Certbot
sudo apt install certbot python3-certbot-nginx

# Get certificate
sudo certbot certonly --nginx -d example.com

# Renew certificate
sudo certbot renew

# Auto-renewal
sudo systemctl enable certbot.timer

openssl x509 -in cert.pem -noout -dates