Yaya TLS/HTTPS ke aiki?

Question

IT Interview Practice · Accepted Answer

**HTTPS kawai HTTP ne da ke gudana cikin tashar da TLS ya ɓoye.** TLS (Transport Layer Security) yana ba ka tabbatattu guda uku: **confidentiality** (an ɓoye zirga-zirga), **integrity** (ba za a iya sauya shi ba tare da an gano ba), da **authentication** (da gaske kana magana da server da aka ambata a certificate). Ana yin sulhu a **handshake** kafin a aika kowane HTTP:

```text
Client                                   Server
  │──── ClientHello ──────────────────────▶│   (TLS versions, cipher suites, random)
  │◀─── ServerHello + Certificate ─────────│   (chosen cipher + cert with public key)
  │                                         │
  │  verify cert against a trusted CA       │
  │  agree on keys (e.g. ECDHE key exchange)│
  │                                         │
  │──── Finished (encrypted) ──────────────▶│
  │◀─── Finished (encrypted) ───────────────│
  │========= encrypted application data ====│   (now HTTP flows, encrypted)
```

Ɓangaren wayo shine haɗa nau'ikan crypto biyu. Ana amfani da cryptography na **asymmetric** (biyu-biyu na public/private key na certificate) na ɗan lokaci kaɗai don *tantance server da yarda cikin aminci a kan sirrin da aka raba*. Wannan sirrin da aka raba sannan yana zama key ga mai sauri **symmetric** encryption (kamar AES) don yawancin bayanai — saboda asymmetric crypto ya yi jinkiri sosai ga kowane byte.

**Authentication** yana dogara ga sarƙar certificate: certificate na server ana sa hannu ta **Certificate Authority (CA)**, kuma OS/browser ɗinka yana zuwa da jerin CAs masu aminci. Idan sarƙar ta halarci kuma suna ya daidaita, an kafa aminci; idan ba haka ba (ya ƙare, ya sa hannu da kansa, host mara daidai), browser yana nuna gargaɗi. **TLS 1.3** na zamani yana sauƙaƙe duk wannan zuwa zagaye ɗaya (0-RTT a sake dawowa) ya kuma jefar da tsofaffin cipher marasa aminci.

## Me ya sa yake da muhimmanci

TLS shine tushen kusan dukkan zirga-zirgar web, don haka fahimtarsa mafari ne ga kowane matsayin backend, security, ko infrastructure. Masu hira suna amfani da shi don gwada ko kana fahimtar **hybrid crypto model** — asymmetric don kafa aminci da key da aka raba, symmetric don sauri — wanda tsari ne da ke maimaituwa a fadin tsarin tsaro. Yana kuma da matuƙar amfani: certificates da suka ƙare, sarƙoƙi marasa aminci, da rashin daidaituwar protocol/cipher su ne abubuwan da suka faru na production na yau da kullum, kuma sanin yadda handshake da tabbatar da certificate ke aiki shine abin da ke bari ka gano su da sauri (misali da `curl -v` ko `openssl s_client`).

Me ya sa yake da muhimmanci

Tambayoyi masu alaƙa