Step 01 of 06
Learn the concept
A TCP socket can connect cleanly to an impostor. TLS is the moment the server must prove, cryptographically, that it is the host you meant to reach. Skip that proof and your monitor is measuring a stranger with a nice socket.
The ideas this is made of
TLS failure starts only after TCP succeeded
TLS is layered on an open connection. TCP provides ordered bytes; TLS gives those bytes confidentiality, integrity and peer authentication. If DialContext fails, TLS never began. If HandshakeContext fails, the path and port worked, but protocol negotiation, certificate verification or cryptographic policy did not. That boundary is diagnostic gold.
ClientHello is the client's menu and name tag
The handshake begins with ClientHello: supported TLS versions, cipher suites, random bytes, extensions and usually SNI. SNI is the hostname hint. Without it, a load balancer hosting hundreds of names may send a default certificate. The IP was right, the port was right, and the identity can still be wrong.
TLS 1.3 cut latency and removed old choices
TLS 1.2 usually takes two round trips after TCP before application data. TLS 1.3 normally takes one. On a 60 ms path, that difference is visible. TLS 1.3 also removed obsolete algorithms and encrypts more handshake metadata. A monitor should record the negotiated version because old protocol fallback is both a latency and policy signal.
Certificate chains link a leaf to a trust anchor
Servers send a leaf certificate and usually intermediates. The client builds a chain to a root already trusted in its local store. The root is not proved over the network; it is the trust anchor. A missing intermediate, untrusted root, wrong hostname or expired certificate breaks verification even when encryption could technically proceed.
Verification is several checks wearing one error
Go verifies signatures, trust roots, validity times, server-auth usage and hostname coverage. The resulting errors can look blunt: x509: certificate is valid for ... or certificate has expired or is not yet valid. Do not hide them with InsecureSkipVerify. That setting says: encrypt the channel, but stop proving who is on the other end.
package main
import (
"crypto/tls"
"fmt"
"net"
)
func main() {
rawConn, err := net.Dial("tcp", "example.com:443")
if err != nil {
fmt.Println("tcp failed:", err)
return
}
defer rawConn.Close()
tlsConn := tls.Client(rawConn, &tls.Config{ServerName: "example.com"})
if err := tlsConn.Handshake(); err != nil {
fmt.Println("tls failed:", err)
return
}
defer tlsConn.Close()
state := tlsConn.ConnectionState()
fmt.Println("version:", state.Version)
fmt.Println("certificates:", len(state.PeerCertificates))
fmt.Println("leaf:", state.PeerCertificates[0].Subject.String())
}tls.Client makes the layer boundary visible. TCP already exists; TLS then verifies the server identity for ServerName and exposes the peer certificate chain through ConnectionState.
TLS versions in operational terms
| Feature | TLS 1.2 | TLS 1.3 |
|---|---|---|
Typical full handshake | 2 round trips | 1 round trip |
Legacy algorithms | Many possible | Mostly removed |
Handshake privacy | More visible | More encrypted |
Monitoring clue | Older endpoint or policy | Modern default |
What these are called on the job
TLS — Transport Layer Security, the protocol behind HTTPS authentication and encryption.
SNI — The ClientHello extension that names the host the client wants.
Leaf certificate — The server certificate for the requested name.
Trust anchor — A root certificate trusted before the handshake begins.
Cipher suite — A negotiated set of cryptographic algorithms for the connection.