Into the wired

how do you resolve an identity crisis in the virtual world?

host
github.com:443
stack
HAProxy → Node, self-signed lab cert
drawn by
02-davinci-01
present day, present time

Layer:01TERMINATION

Send a request and follow it across the wire. Plain HTTP shows everything to anyone on the line. HTTPS seals it, but then the load balancer has a choice: pass the sealed stream through blind, or open it and route by what's inside.

public internetthe wiredyour private networksomeone on the wireYoubrowserHAProxy:443 ssl crt site.pempath_beg /apipath_beg /staticeverything elsenode-a:3001, the APIneeds cert + keynode-b:3002, static filesneeds cert + keynode-c:3000, the appneeds cert + key

What someone on the wire sees

send a request

What HAProxy can read

send a request

What the backend receives

send a request
everyone is connected
layer01 of 04
titleTermination
subjectHTTP vs HTTPS, L7 routing
revisionB, Sep 2026
drawn by02-davinci-01

Layer:02EXCHANGE

How two strangers end up holding the same secret while every message between them is public. Paint stands in for the maths: mixing is easy, unmixing is practically impossible. The letters show exactly what went into each mix.

Y: public, everyone has itB: your secretG: github.com’s secretR: Mallory’s secret

A key that was never sent

You
your secret
never leaves this box
you send
you compute
on the wire, visible to everyone
the public colour
Y
github.com
its secret
never leaves this box
it sends
it computes

You and github.com agree on a public colour, Y, out in the open. You secretly pick B. github.com secretly picks G. Neither secret ever leaves its box.

Clever, but it can't tell who

You
your secret
you send
you receive, and assume it’s github.com’s
you compute
Mallory
her secret
she sits on the wire
she sends to both sides
her key with you
her key with github.com
affiliation: knights of the eastern calculus, probably
github.com
its secret
it sends
it receives, and assumes it’s yours
it computes

The same exchange, but Mallory sits on the wire with her own secret, R. Every message passes through her.

nothing crossed the wire
layer02 of 04
titleExchange
subjectDiffie-Hellman, man in the middle
revisionB, Sep 2026
drawn by02-davinci-01

Layer:03IDENTITY

The piece Layer:02 was missing. Run the command against a site with a good chain, then one with a broken chain, and watch the output get read as a chain of seals, from a root you already trust down to this very connection.

navi · copland os
copland os · naviconnecting to the wired … ok Pick a tab above, or run the prompt below.

Reading the chain

trust flows from something you already have
  1. root CAUSERTrust ECCalready on your machine, never sentK·root
  3. intermediate CASectigo DV E36sent by the server, with 1 more intermediate above itK·int
  5. leaf certificategithub.comsent by the server, the name you asked forK·leaf
  7. this handshakeyour connectionthe transcript, both paint mixes included

Run the command above. Each seal below gets checked in order.

Why the last seal can't be faked

public key, printed in the certificaten = 3233, e = 17
private key, never leaves github.comd = 2753
hash of this handshake, both mixes includedh = 65
github.com seals it with the private keys = 652753 mod 3233 = 588
you open the seal with the public key58817 mod 3233 = 65 = h ✓
Mallory has the certificate, but not d123417 mod 3233 = 2183 ≠ h ✕

github.com holds a key pair. The public half is printed in its certificate for anyone to read. The private half never leaves the server.

Toy numbers. Real keys are 2048-bit RSA or 256-bit ECDSA, and github.com uses ECDSA. The idea is the same for both: only the private key can make the seal, and anyone with the public key can check it.

who is on the other side
layer03 of 04
titleIdentity
subjectchain of trust, CertificateVerify
revisionprotocol 7
drawn by02-davinci-01
Layer:04 · sponsored

Click here for a FREE CA certificate!!

Root-signed. Wildcard. Works everywhere. $499.99 $0.00

*browsers that trust everything. 3,142 people claimed theirs today. Offer void where trust is required.