EXERCISE 1 — Watching a TLS 1.2 handshake message by message
=============================================================

Command:
  openssl s_client -connect example.com:443 -servername example.com -tls1_2 -msg </dev/null

  -tls1_2 forces TLS 1.2 (so you see the full classic handshake, not 1.3).
  -msg prints each handshake message as it is sent/received.
  (If the server refuses 1.2, try a host that still allows it.)

WHAT YOU SEE, mapped to the 8 steps:

  >>> TLS 1.2 Handshake [ClientHello]        -> Step 1  (we send)
  <<< TLS 1.2 Handshake [ServerHello]        -> Step 2  (server's choices)
  <<< TLS 1.2 Handshake [Certificate]        -> Step 3  (leaf + chain)
  <<< TLS 1.2 Handshake [ServerKeyExchange]  -> Step 4  (signed DH value)
  <<< TLS 1.2 Handshake [ServerHelloDone]    -> Step 5  (end of server hello)
  >>> TLS 1.2 Handshake [ClientKeyExchange]  -> Step 6  (our DH value)
  >>> TLS 1.2 ChangeCipherSpec               -> Step 7  (we switch to encryption)
  >>> TLS 1.2 Handshake [Finished]           -> Step 7  (encrypted transcript hash)
  <<< TLS 1.2 ChangeCipherSpec               -> Step 7  (server switches)
  <<< TLS 1.2 Handshake [Finished]           -> Step 7  (server's transcript hash)
  ... then application data (Step 8) ...

  >>> = sent by client, <<< = received from server.

WHICH MESSAGES FLOW BEFORE ENCRYPTION BEGINS:
  - EVERYTHING up to and including each side's ChangeCipherSpec is in the
    CLEAR: ClientHello, ServerHello, Certificate, ServerKeyExchange,
    ServerHelloDone, ClientKeyExchange.
  - The Finished message is the FIRST encrypted handshake message (it comes
    right after ChangeCipherSpec). That's why Finished can act as the
    integrity seal — it's protected by the new keys AND covers the cleartext
    messages that came before it.

NOTE: with the default (no -tls1_2) you'd get a TLS 1.3 handshake, which
looks different (no ServerKeyExchange/ServerHelloDone, fewer round trips) —
that's exactly the Chapter 7 contrast.