   HTTPS Handshake
  I'm wondering how to "do" the handshake procedure for a HTTPS connection.I searched for hours on the web, but nothing clear came up. After connection to a server, that supports HTTPS, what message do I need to send in order to initiate the handshake procedure? This site states that the client sents a "hello", as well as the server as a response to that.I did read the official netscape ssl3 paper, but it's not very easy to understand:Quote:struct {    uint32 gmt_unix_time;    opaque random_bytes[28];} Random;opaque SessionID<0..32>;uint8 CipherSuite[2];enum { null(0), (255) } CompressionMethod;struct {    ProtocolVersion client_version;    Random random;    SessionID session_id;    CipherSuite cipher_suites<0..2^16-1>;    CompressionMethod compression_methods<0..2^8-1>;} ClientHello;[Page 23]I do understand parts of this, but not everything. I think my biggest problem is, how I need to format this data, to send it to the server. The paper sais that each "data member" normaly occupies 1 byte.The Random structure would then occupie 4byte for the time and 28bits for this random number etc...I'm trying to do this in c++ with CAsyncSocket.But I don't know how to create this header. How can I copy data into a buffer that is not a multiple of 8bits? What kind of data do I need to fill in for the cipher suite and compression method, how is it formatted?Just to clarify, I don't want to do ALL the handshaking, I'm just interested to initiate it.   
Quote:opaque random_bytes[28];This is 28 bytes. Or 224 bits.Quote:but it's not very easy to understand:No... cryptography isn't an easy issue.Quote:What kind of data do I need to fill in for the cipher suite and compression method, how is it formatted?Section A.6 of the draft.Quote:how I need to format this dataSection 4.1 of the draft.Quote:After connection to a server, that supports HTTPS, what message do I need to send in order to initiate the handshake procedure?Section 5.6, starting with 5.6.1, there's also another overview here.   ;Quote:Original post by SiS-ShadowmanJust to clarify, I don't want to do ALL the handshaking, I'm just interested to initiate it.RFC 2246 is the official definition of the Transport Level Security (TLS) protocol.But, why do you want to just initiate a TLS session nego?  Are you just interested in implementing DOS attacks resembling the classic SYN cookie DOS?There are two good ways to approach your problem if you don't want to or can't understand the officialese technospeak of the RFC (I know I have trouble, and I do it for a living).  (1) Grab an open source library like OpenSSL or GnuTLS and study that code, or (2) Use a wire protocol analyser to view the actual bytes sent across the write for the client-initiation package.--smw   ;  Thanks antheus. You cleared my mind :D.Okay, I think with that info, I can do it.I know it may look strange, but I do not wish to implement any attack. I'm working on a little programm ( to get network coding experience ) that checks wether servers are alive or not. It can contact a normal http and ftp server and I wanted to add support for https.   ;  I'd also recommend OpenSSL. I got my MSN client connecting fine after 15 mins with OpenSSL (MSN uses HTTPS for the login)   ;  Okay, I'll follow your advise. I'll lok into openssl. Should be easier than to reinvent the wheel ^^   