# TLS handshake Published articles for TLS handshake. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy DevFeed: [Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy]() Original publisher: [Read original article]() Author: Philipp Lehmann (philipp.lehmann@gruppe.ai) Published: 2026-09-15T07:00:00Z Content type: tutorial Language: en Sources: [Philipp Lehmann]() Topics: [tailscale](), [proxy](), [traefik](), [TLS (Transport Layer Security)](), [TLS handshake](), [Self-hosted](), [Homelab]() Tags: [dns](), [docker](), [h2](), [homelab](), [networking](), [proxy](), [reverse-proxy](), [security](), [self-hosted](), [tailscale](), [tls](), [tls-handshake](), [traefik]() ### AI overview This tutorial explains how to run a self-hosted Tailscale control server, Headscale, behind Traefik. It finds that the reverse proxy must use TLS with HTTP/1.1 only because Tailscale's noise handshake expects a full-duplex byte stream and can fail when ALPN negotiates HTTP/2. ### Source excerpt Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2. ## Enabling TLS in PXC without Downtime DevFeed: [Enabling TLS in PXC without Downtime]() Original publisher: [Read original article]() Author: Juan Arruti Published: 2026-09-09T23:32:15Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [TLS (Transport Layer Security)](), [Replication](), [Security](), [Network](), [openssl]() Tags: [galera](), [high-availability](), [insight-for-dbas](), [mysql](), [open-source](), [percona](), [pxc](), [replication](), [security](), [ssl](), [tls](), [tls-handshake](), [uncategorized](), [xtradb-cluster-pxc]() ### AI overview This tutorial explains how to enable TLS for replication traffic in Percona XtraDB Cluster without a full cluster restart. Using Galera's socket.dynamic option, operators can perform two rolling restarts: first allowing encrypted and plaintext connections, then enforcing TLS-only communication. ### Source excerpt Starting with Percona XtraDB Cluster (PXC) 8.0, replication traffic encryption is enabled by default. That said, it's common to find clusters running without TLS that suddenly need it: a new compliance requirement, an audit finding, a network segment that is no longer considered trusted. PXC has a variable for exactly that case, pxc-encrypt-cluster-traffic, which handles ... Continued The post Enabling TLS in PXC without Downtime appeared first on Percona. ## Quality Outreach Heads-up - JDK 28: Named Group Information Captured in the TLSHandshake JFR Event DevFeed: [Quality Outreach Heads-up - JDK 28: Named Group Information Captured in the TLSHandshake JFR Event]() Original publisher: [Read original article]() Author: Ana-Maria Mihalceanu Published: 2026-08-21T00:00:00Z Content type: release Language: en Sources: [Inside Java]() Topics: [JDK 28](), [Flight](), [TLS (Transport Layer Security)](), [Security](), [openjdk]() Tags: [jdk-28](), [jdk-flight-recorder](), [openjdk](), [release](), [security](), [tls](), [tls-handshake](), [update]() ### AI overview The OpenJDK Quality Group announces that, starting with JDK 28, the jdk.TLSHandshake JFR event records the named group negotiated between the client and server during key exchange. The event is disabled by default and requires explicit enablement. ### Source excerpt This Heads-Up is part of the regular communication sent to the projects involved; it covers that the named group information is included in the jdk.TLSHandshake JFR event. ## Networking Concepts Every DevOps Engineer Needs to Know DevFeed: [Networking Concepts Every DevOps Engineer Needs to Know]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-14T17:14:08Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [networking](), [DevOps](), [browser](), [Kubernetes]() Tags: [browser](), [cidr-and-subnets](), [cloud](), [conntrack](), [devops](), [dns](), [ephemeral-ports](), [kubernetes](), [kubernetes-networking](), [linux](), [mtu-mismatch](), [nat-and-snat](), [network](), [network-troubleshooting-commands](), [networking](), [networking-concepts-for-devops](), [osi-model-for-devops](), [platform-engineering](), [proxy](), [routing](), [tcp](), [tcp-handshake](), [timeout](), [tls-handshake](), [vpn]() ### AI overview A tutorial follows a request from a browser to a container to explain networking concepts relevant to DevOps engineers. It maps symptoms such as connection refusal, timeouts, resets, and packet-size-related hangs to network layers and discusses diagnosis across VPN gateways, Kubernetes, and other infrastructure. ### Source excerpt Follow one request from a browser to a container and back. Every networking concept you actually need shows up on that path, in order, and so does every place it breaks. ## Using observability to verify TLS certificate rotation in production DevFeed: [Using observability to verify TLS certificate rotation in production]() Original publisher: [Read original article]() Author: Sridhar Rajarao Published: 2026-08-13T00:00:00Z Content type: article Language: en Sources: [Sridhar Rajarao]() Topics: [TLS (Transport Layer Security)](), [observability](), [TLS handshake](), [Automation](), [nginx](), [Kubernetes]() Tags: [automation](), [nginx](), [observability](), [reliability](), [sre](), [tls](), [tls-handshake]() ### AI overview The article explains that automating certificate renewal does not prove that production endpoints serve the new certificate. It recommends externally probing customer-facing endpoints and measuring certificate details and real TLS handshakes across proxies, regions, ingress controllers, CDNs, gateways, and other endpoints. ### Source excerpt Automation renews a certificate. Observability proves every endpoint is serving it and customers can complete a TLS handshake. ## How to provision certificates for internal services with Teleport Workload Identity DevFeed: [How to provision certificates for internal services with Teleport Workload Identity]() Original publisher: [Read original article]() Author: noah@goteleport.com (Noah Stride) Published: 2025-02-18T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [certificates](), [TLS (Transport Layer Security)](), [TLS handshake](), [Encryption](), [Cryptography](), [trust](), [Authentication](), [Authorization](), [Networks]() Tags: [authentication](), [authorization](), [certificates](), [cryptography](), [encryption](), [networks](), [tls](), [tls-handshake](), [trust](), [x509]() ### AI overview This tutorial explains how to provision X.509 certificates for internal services with Teleport Workload Identity. It covers TLS, mutual TLS, certificate authorities, workload identity, and the role of certificates in authenticating services and securing internal traffic. ### Source excerpt Learn how to securely provision X509 certificates to secure traffic between internal services using mTLS and Teleport Workload Identity. ## TLS Routing Support for Teleport Behind an AWS Application Load Balancer DevFeed: [TLS Routing Support for Teleport Behind an AWS Application Load Balancer]() Original publisher: [Read original article]() Author: info@goteleport.com (Steve Huang) Published: 2022-11-18T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Load Balancing](), [TLS (Transport Layer Security)](), [Amazon Web Services](), [networking](), [HTTP](), [Amazon Bedrock]() Tags: [aws](), [high-availability](), [https](), [load-balancer](), [load-balancing](), [tls](), [tls-handshake]() ### AI overview This article explains TLS Routing support for Teleport Database Access when Teleport runs behind an AWS Application Load Balancer. It compares application and network load balancers and discusses TLS termination, mutual TLS, ALPN, SNI, and certificate handling. ### Source excerpt How to "penetrate" an AWS Application Load Balancer to enable mutual TLS (mTLS), Application-Layer Protocol Negotiation (ALPN), and more. ## How OkCredit Android App boosted Network Performance by 30% DevFeed: [How OkCredit Android App boosted Network Performance by 30%]() Original publisher: [Read original article]() Author: Shrey Garg Published: 2022-07-07T11:29:22Z Content type: tutorial Language: en Sources: [OkCredit - Medium]() Topics: [Mobile](), [Android](), [android-apps](), [Instrumentation](), [Network](), [Latency](), [HTTP](), [TLS handshake]() Tags: [android](), [android-app-development](), [android-apps](), [engineering](), [http](), [instrumentation](), [latency](), [mobile-app-development](), [network](), [okcredit](), [performance](), [tls-handshake](), [user-experience]() ### AI overview This tutorial explains how to analyze and optimize each stage of network calls in Android apps, including call start, DNS resolution, TLS connection setup, request and response transfer, connection reuse, and call completion. It describes using OkHttp connection pooling and the EventListener class to instrument HTTP-call metrics such as quantity, size, and duration. ### Source excerpt Fast and reliable network communication is crucial for OkCredit mobile apps. Since the majority of our users belong to Tier-2/3 cities in India, flaky and unreliable network connection is one of the biggest challenges for us. In order to deliver a good user experience, our mobile apps need to have reliable and low-latency network connectivity. While most resources we found describe how we can improve the overall time (start-end) of a network call, this article attempts to take a deep dive and talk about each step and how we can instrument and optimise each step of a network call in android apps. Steps involved in a network callFig. Steps of a Network call. Ref -- https://square.github.io/okhttp/features/events1. Call start Called as soon as a call is enqueued or executed by a client. Ideally, this step should not consume any time unless there are any custom Interceptors added. 2. DNS Involves the DNS Resolver translating the domain name into the corresponding identifier (the IP address). 3. Connection Start Tries to acquire a secure connection (TLS handshake) between the client and the server. 4. Connection End / Acquired Invoked after a connection has been acquired for the call. After this, the communication of request and response payloads is started. 5. Request / Response / Headers This is the step in which the actual communication of data happens. The HTTP method, size of request / response payload, server latency / response time, etc. can greatly impact the time taken by this step. 6. Connection released Invoked after a connection has been released for the call. 7. Call end Invoked immediately after a call has completely ended. Pooled connection OkHttp has the capability to pool connections with which it can skip various steps of a network call mentioned above, which in turn can greatly improve the application's network performance, as existing connections can be reused. Fig. Steps of a Network call with pooled connectionInstrumentation of each step To determine ## Using TLS Extensions to Route Traffic and Reduce Port Requirements in Teleport DevFeed: [Using TLS Extensions to Route Traffic and Reduce Port Requirements in Teleport]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2021-12-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [TLS (Transport Layer Security)](), [TLS handshake](), [Routing (disambiguation)](), [SSL](), [Server]() Tags: [https](), [port](), [route](), [security](), [ssl](), [tls](), [tls-handshake]() ### AI overview This tutorial explains how Teleport uses TLS extensions, including ALPN and SNI, to route traffic more efficiently and reduce the number of required open ports. It also distinguishes the TLS protocol from the X.509 certificates used with it. ### Source excerpt How to leverage TLS extensions to more efficiently route traffic and reduce port requirements in Teleport. ## Dissecting SSL handshake DevFeed: [Dissecting SSL handshake]() Original publisher: [Read original article]() Author: Marek Published: 2012-06-15T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [TLS handshake](), [SSL](), [TLS (Transport Layer Security)](), [browser](), [client](), [data]() Tags: [application](), [browser](), [deprecated](), [privacy](), [ssl](), [tls](), [tls-handshake]() ### AI overview This article examines the information exposed by the unencrypted SSL/TLS handshake, focusing on the ClientHello message. It describes fields such as the protocol version, client-generated random value, session identifier, supported cipher suites and compression methods, and discusses how these details may reveal client characteristics or enable identification, including through session reuse and cipher-suite ordering. ### Source excerpt Dissecting SSL handshake Not everyone knows that the SSL handshake is not encrypted. When you think about it - there isn't other way, before the keys are exchanged the communication must be unencrypted. But I doubt many people think about it. Not only the SSL handshake is plain-text, but also it contains rather interesting data. I decided to find out how much information can be retrieved from it. TLS Here's how the TLS handshake works: Let's focus on the first message - .