HTTPS: TCP, TLS and web communication

Lesson plan

Level

Beginner

Time

About 70 minutes; the steps below add up to 69

Learners list everything a laptop must do in the second before a page appears, and choose what comes first, so the four jobs come from them before the overview. Predictions then precede what DNS proves, why computers greet each other first, what TCP leaves open, why a key cannot simply be sent, what malware in the browser sees and what an observer can see; checks follow the certificate checks, the switch’s choice and the reused connection. The habit to build: for each job, say what it protects and what it leaves visible.

Objectives

• Put the four jobs of a new HTTPS page load in order: DNS, TCP, TLS, HTTP
• Explain what DNS and TCP each provide, and what neither does
• Describe the three jobs of TLS and what a certificate warning means
• Say what an observer can and cannot see of an HTTPS connection
• Explain how cached answers, open connections and HTTP/3 change the sequence

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Ports and Sockets and IP forwarding lessons first.
• Write the four jobs (find, connect, secure, ask) across the top of the board and tick them off as the lesson goes.
• The lesson takes about 69 minutes. To teach it in two parts, stop after “4. Send the protected HTTP request”; the second part opens with “5. Receive and render the response”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Put the four jobs of a new HTTPS page load in order: DNS, TCP, TLS, HTTP
   • Explain what DNS and TCP each provide, and what neither does
   • Describe the three jobs of TLS and what a certificate warning means
   • Say what an observer can and cannot see of an HTTPS connection
   • Explain how cached answers, open connections and HTTP/3 change the sequence

   Purpose: Learners list everything a laptop must do in the second before a page appears, and choose what comes first, so the four jobs come from them before the overview. Predictions then precede what DNS proves, why computers greet each other first, what TCP leaves open, why a key cannot simply be sent, what malware in the browser sees and what an observer can see; checks follow the certificate checks, the switch’s choice and the reused connection. The habit to build: for each job, say what it protects and what it leaves visible.

2. 1. One second, one page Think 5 min

   Purpose: Find the four jobs from the learners before the overview names them.

   Ask

   • What must happen in that second?
   • What comes first?

   Responses to expect

   • The address and encryption come quickly; the connection itself is often missed.
   • On screen in turns: the opening question, its answer; then the question on what must happen first, and its answer.

   Discussion pause: Collect a list on the board and order it together before revealing.

   In the lesson window

   • Think it through: You type a website’s name into a browser and the page appears about a second later. List everything the laptop must find out or set up in that second before it can show the page.
   • Think it through: Which of these must happen first?

3. 2. Start with a website address Explain 5 min

   Purpose: Step through the four jobs one at a time and define HTTPS as HTTP inside TLS.

   Ask

   • What is HTTPS?

   Responses to expect

   • Some think HTTPS replaces TCP.
   • Diagram: before each job appears, ask which job must come next and why it depends on the one before.
   • On screen in turns: the opening; then the four jobs, one at a time; the diagram’s stages one at a time; the question on what HTTPS is, and its answer; HTTPS: HTTP carried inside TLS; the example addresses.

   In the lesson window

   • Think it through: Look at jobs 3 and 4 of the journey. What do you think HTTPS is?

4. 3. 1. Find the server with DNS Predict 6 min

   Purpose: Explain DNS as a directory, and that it proves nothing about identity.

   Ask

   • How do you find a number you do not know?
   • Does the answer prove who is there?

   Responses to expect

   • Many assume DNS checks the server.
   • On screen in turns: the opening question, its answer; then DNS, the internet’s phone book; how a DNS lookup works, starting with the cache; asking the resolver; working through the hierarchy; the answer, and what a lookup reveals; the question on whether DNS proves identity, and its answer; DNS says where, not who.

   Misconceptions to challenge

   • A learner may believe: “DNS is part of HTTPS.” Respond: It is a separate service that finds the address first.

   In the lesson window

   • Think it through: You know a friend’s name but not their phone number. How do you find the number? How might a laptop find the address for www.example.com?
   • Think it through: DNS returned 198.51.100.20. Does that prove the server at that address is the real www.example.com?

5. 4. 2. Establish TCP transport Predict 7 min

   Purpose: Explain the handshake and what TCP does and does not provide.

   Ask

   • Why greet before talking?
   • Is the connection private yet?

   Responses to expect

   • “Private” is a common wrong guess.
   • On screen in turns: the opening; then the question on ringing first, and its answer; the three-message handshake, starting with SYN; SYN-ACK; ACK; what TCP provides from here; the question on whether the connection is private, and its answer; what TCP does not do; what the server was doing before the laptop called.

   Discussion pause: Reveal the handshake one message at a time; ask who sends the next message, and what it says, before it appears.

   If the explanation does not land: Act out the handshake: three learners pass three cards, SYN, SYN-ACK and ACK.

   In the lesson window

   • Think it through: Before two people talk on the telephone, one rings, the other answers, and the first confirms they can hear. Why might two computers do something similar before sending a web page?
   • Think it through: TCP now delivers everything, in order, and resends anything lost. Is the connection private, and is the server proven genuine?

6. 5. 3. Negotiate TLS security Predict 9 min

   Purpose: Explain the three jobs of TLS and what a warning means.

   Ask

   • What is wrong with sending the key?
   • What should the browser do with a wrong name?

   Responses to expect

   • Some say “encrypt the key”, which needs a key already; leave the puzzle for Module 6.
   • On screen in turns: the opening; then job 1: check the server’s identity; the question on simply sending the key, and its answer; job 2: agree a key without sending it; job 3: encrypt with the session key; the TLS handshake, starting with the laptop’s Hello; the server’s Hello; the certificate and proof; the laptop’s check and confirmation; the check question on a certificate with the wrong name, and its answer; what a certificate warning means; the TLS 1.3 message names.

   Misconceptions to challenge

   • A learner may believe: “Clicking through a warning is harmless.” Respond: It means identity could not be confirmed.

   Discussion pause: Reveal the TLS handshake one stage at a time; before the last stage, ask what the laptop must check before it confirms.

   To go further

   • If the key is never sent, how could both sides end up with the same one? (Lesson 6.9 answers this.)

   In the lesson window

   • Think it through: Both sides need the same secret key, but anyone on the path can read what they send. What is wrong with simply sending the key?
   • Check your understanding: A certificate is in date and issued by a trusted authority, but names a different website. What should the browser do?

7. 6. 4. Send the protected HTTP request Predict 4 min

   Purpose: Show the plain request, and that protection covers the journey, not the ends.

   Ask

   • Can malware in the browser read it?

   Responses to expect

   • Learners often believe TLS protects everything everywhere.
   • On screen in turns: the opening; then what an observer sees of the request; the question on the two ends, and its answer; the journey is protected, not the two ends.

   In the lesson window

   • Think it through: TLS protects the request on its way. Can malicious software inside the browser read it?

8. 7. 5. Receive and render the response Predict 6 min

   Purpose: Complete the journey and read the observer’s table.

   Ask

   • Which four things could the watcher see?

   Responses to expect

   • Most think the name of the site is hidden.
   • On screen in turns: the opening; then the question on what an observer could see, and its answer; the observer’s table, with the answers held back; whether each is visible, and why; the honest meaning of the padlock.

   Misconceptions to challenge

   • A learner may believe: “HTTPS hides everything about browsing.” Respond: Addresses, timing, volume and ordinary DNS lookups stay visible.

   Discussion pause: The table’s answers are held back: let the class say whether each row is visible, and why, before revealing the columns.

   In the lesson window

   • Think it through: Someone is watching the school’s network during that second. Before looking at the table, which could they see: the name looked up, the server’s address, the page requested, what was typed into a form?

9. 8. How does a protocol make this happen? Explain 4 min

   Purpose: Place the protocols in software and separate the two meanings of port.

   Ask

   • Which does the switch use, the switch port or the TCP port?

   Responses to expect

   • A few still mix the two.
   • On screen in turns: the opening; then the four basic elements; the check question on what a switch reads, and its answer; two kinds of port; the frame for a server outside the school.

   In the lesson window

   • Check your understanding: The laptop’s cable is in switch port 5 and the connection uses TCP port 443. Which does the switch use to choose where to send a frame?

10. 9. What HTTPS does not hide Predict 5 min

    Purpose: Separate content from metadata, and a valid certificate from an honest site.

    Ask

    • Could a fake shop show a padlock?

    Responses to expect

    • Many believe it could not.
    • On screen in turns: the opening; then what the school network can see, starting with the lookup; the connection; the content, and the result; the question on a criminal’s certificate, and its answer; a certificate proves the name, not honesty.

    Misconceptions to challenge

    • A learner may believe: “The padlock means the website is safe.” Respond: It means the connection is protected and the name matched.

    In the lesson window

    • Think it through: A criminal sets up a convincing fake shop on a domain they own. Could the site show a valid certificate and a padlock?

11. 10. HTTP/3 uses a different transport sequence Explain 4 min

    Purpose: Show that the four-job order is typical, not universal.

    Ask

    • Which jobs does an open connection skip?

    Responses to expect

    • Steps 1 to 3.
    • On screen in turns: the opening; then where the four-step order does not hold; the check question on what an open connection skips, and its answer; when a certificate warning appears.

    In the lesson window

    • Check your understanding: The laptop opened a page on the same site a minute ago, and the connection is still open. Which jobs does the next request skip?

12. 11. Apply it in a new situation Apply 5 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The café tests the observer’s view; payroll tests warnings; “not found” tests the order of jobs.
    • On screen in turns: the opening; then the café Wi-Fi question, and its answer; the payroll warning question, and its answer; the “server not found” question, and its answer.

    In the lesson window

    • Apply it: On a café’s Wi-Fi, a friend checks their bank balance over HTTPS. What could the café’s network owner learn?
    • Apply it: A work laptop shows a certificate warning for the company’s payroll site. A colleague says to click through because “it is our own site”. What do you do?
    • Apply it: A browser says “server not found” for a site that opens on your phone over mobile data. Which of the four jobs failed?

13. 12. Check your understanding Check 6 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The HTTP/3 question links to the last teaching step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

14. 13. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four jobs, in order.

    Responses to expect

    • Find, connect, secure, then ask and answer.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Find, connect, secure, then ask.
    • DNS finds; it does not vouch.
    • TCP is reliable, not private.
    • TLS checks identity, agrees a key and encrypts.
    • The padlock protects content, not the fact of the visit, and not honesty.

Consolidation

• Find, connect, secure, then ask.
• DNS finds; it does not vouch.
• TCP is reliable, not private.
• TLS checks identity, agrees a key and encrypts.
• The padlock protects content, not the fact of the visit, and not honesty.