TLS and certificates

TLS encrypts and authenticates traffic between client and server. The handshake negotiates cipher suites, verifies the certificate chain against trusted CAs, and establishes session keys. SNI lets one IP host multiple certificates; ALPN selects HTTP/2 versus HTTP/1.1 during handshake. Session resumption (tickets, session IDs) cuts repeat handshake cost.

					ClientHello → ServerHello + cert chain → key exchange → Finished → encrypted HTTP
				

Termination can happen at the load balancer, reverse proxy, or Node process — each choice shifts certificate ownership, HSTS enforcement, and what the upstream sees (plain HTTP vs re-encrypted).

On interviews: explain chain of trust, why self-signed fails in browsers, mTLS for service-to-service trust, and common misconfigurations (expired certs, wrong hostname, incomplete chain).

Common pitfalls: terminating TLS at the edge but forgetting to validate upstream certificates; disabling verification in Node (`NODE_TLS_REJECT_UNAUTHORIZED`); mixing HTTP and HTTPS internal hops.

The trade-off is operational complexity at the edge versus end-to-end encryption inside the data center.

Checklist:

• Walk through handshake and what adds latency.
• Name SNI, ALPN, and resumption benefits.
• State where termination happens in your architecture.
• Never disable cert verification in production.