← Lab Notes
July 2, 2026 homelabnetworkingtlshttps

Networking Basics #7: TLS and HTTPS — What the Padlock Does for breadtoasting.com

Learn about TLS/HTTPS, from encryption to authentication, and how it's implemented on my homelab setup.

Overview

This is part 7 of a series on networking basics. Today, we dive into the ins and outs of Transport Layer Security (TLS) and HTTPS, focusing specifically on their implementation for breadtoasting.com. We'll cover encryption, integrity, authentication, and some practical checks to ensure everything is working as it should.

sequenceDiagram
  participant C as Browser
  participant S as Server
  C->>S: ClientHello
  S->>C: ServerHello and certificate
  C->>S: Key exchange
  Note over C,S: Encrypted channel ready

Background

At breadtoasting.com, we rely on cloud-based services to handle TLS termination and certificate management. This setup simplifies our homelab environment while still providing robust security for our visitors. In this post, I'll walk through the basics of TLS/HTTPS, explain how it works in my setup, and provide some practical tips for checking its effectiveness.

How It Works

TLS (Transport Layer Security) provides three key benefits:

  • Encryption: Ensures that data is not read by anyone on the network path.
  • Integrity: Prevents tampering of data during transit.
  • Authentication: Verifies that you are communicating with the correct server, via a certificate chain to a trusted Certificate Authority (CA).

Our Cert Situation

For breadtoasting.com, TLS termination happens at Cloudflare's edge. They issue and automatically renew our certificates. Traffic then travels through an authenticated tunnel to my homelab. This setup is significantly simpler than the classic Let’s Encrypt + certbot approach, where domain control validation via ACME challenges, certificate renewal every 90 days, and automation are key.

Concepts for Beginners

What a Certificate Contains

A typical SSL/TLS certificate includes:

  • Domain Names: The names associated with the certificate.
  • Public Key: Used to encrypt data that only the corresponding private key can decrypt.
  • Expiry Date: When the certificate will no longer be valid.
  • Issuer Signature: A digital signature from a trusted Certificate Authority (CA) that verifies the certificate's contents.

Browsers trust a bundle of root CAs, and the chain must connect back to one of these roots for the certificate to be considered valid.

The TLS Handshake

The TLS handshake process can be summarized in three steps:

  1. Client Hello: The client initiates the connection by sending a "hello" message that includes supported cipher suites.
  2. Server Certificates: The server responds with its certificate, which includes the public key and other information.
  3. Key Exchange & Symmetric Encryption: A shared secret is established for encrypting the actual data.

Mixed Content Warnings

Mixed content warnings occur when an HTTPS page attempts to load HTTP resources. This can happen if you're using relative URLs or if your site has insecure third-party scripts.

Internal Traffic Honesty

Within my homelab, traffic between services like Nginx and the blog backend is unencrypted (plain HTTP). Given our threat model, where traffic never leaves the host, this is acceptable. However, for a larger setup, mutual TLS (mTLS) might be necessary to ensure end-to-end encryption.

Results

To verify that everything is working correctly, here are some practical checks:

Practical Checks

  1. Using openssl s_client:

    openssl s_client -connect breadtoasting.com:443

    This command will give you detailed information about the TLS connection, including the certificate chain.

  2. Browser Cert Viewer: Most modern browsers have a built-in Certificate Viewer that can be accessed via right-clicking on the padlock icon in the address bar.

  3. crt.sh Transparency Logs:
    Visit crt.sh and enter your domain to see every certificate ever issued for it. This is useful for verifying the chain of trust.

Lessons Learned

  1. Simplicity vs. Security: While cloud-based solutions simplify management, they still provide robust security.
  2. Automation: Letting Cloudflare handle renewals and cipher configurations means less manual work but also less control over these aspects.
  3. Practical Checks: Regularly running checks ensures that your TLS setup remains secure.

By understanding the basics of TLS/HTTPS and implementing them correctly, you can ensure that your homelab or personal projects are both secure and user-friendly.

Was this useful?