val call1 = localClient.newCall(Request(server.url("/")))

    call1.execute().use { response ->
      assertThat(response.body.string()).isEqualTo("Req1")
      assertThat(response.handshake).isNotNull()
      assertThat(response.protocol == Protocol.HTTP_1_1)
    }

    eventListener.closed = true

    val call2 = localClient.newCall(Request(server.url("/")))

<img src="/img/deployment/https/https01.drawio.svg">

### Початок TLS рукостискання { #tls-handshake-start }

Потім браузер зв'яжеться з цією IP-адресою на **порту 443** (порт HTTPS).

Перша частина комунікації - це просто встановлення з'єднання між клієнтом і сервером та узгодження криптографічних ключів тощо.

<img src="/img/deployment/https/https01.drawio.svg">

### Начало TLS-рукопожатия { #tls-handshake-start }

Далее браузер будет общаться с этим IP‑адресом на **порту 443** (порт HTTPS).

Первая часть взаимодействия — установить соединение между клиентом и сервером и договориться о криптографических ключах и т.п.

首先，浏览器将通过 **DNS 服务器** 查询**域名的IP** 是什么，在本例中为 `someapp.example.com`。

DNS 服务器会告诉浏览器使用某个特定的 **IP 地址**。 这将是你在 DNS 服务器中为你的服务器配置的公共 IP 地址。

<img src="/img/deployment/https/https01.drawio.svg">

### TLS 握手开始 { #tls-handshake-start }

然后，浏览器将在**端口 443**（HTTPS 端口）上与该 IP 地址进行通信。

通信的第一部分只是建立客户端和服务器之间的连接并决定它们将使用的加密密钥等。

<img src="/img/deployment/https/https02.drawio.svg">

客户端和服务器之间建立 TLS 连接的过程称为 **TLS 握手**。

DNS 서버는 브라우저에게 특정 **IP 주소**를 사용하라고 알려줍니다. 이는 DNS 서버에 설정해 둔, 서버가 사용하는 공개 IP 주소입니다.

<img src="/img/deployment/https/https01.drawio.svg">

### TLS 핸드셰이크 시작 { #tls-handshake-start }

그 다음 브라우저는 **포트 443**(HTTPS 포트)에서 해당 IP 주소와 통신합니다.

통신의 첫 부분은 클라이언트와 서버 사이의 연결을 설정하고, 사용할 암호화 키 등을 결정하는 과정입니다.

<img src="/img/deployment/https/https02.drawio.svg">

now allows providing the user uid. ([#49677](https://github.com/kubernetes/kubernetes/pull/49677), [@dims](https://github.com/dims))

* After a kubelet rotates its client cert, it now closes its connections to the API server to force a handshake using the new cert. Previously, the kubelet could keep its existing connection open, even if the cert used for that connection was expired and rejected by the API server. ([#49899](https://github.com/kubernetes/kubernetes/pull/49899), [@ericchia...

- `client-go`, using log level 9, traces the following events of a HTTP request:
      - DNS lookup
      - TCP dialing
      - TLS handshake
      - Time to get a connection from the pool
      - Time to process a request ([#105156](https://github.com/kubernetes/kubernetes/pull/105156), [@aojea](https://github.com/aojea))

### Documentation

derived), hash: s.hash, } } // ClientHandshakeTraff derives the client_handshake_traffic_secret from // the handshake secret and the transcript up to the ServerHello. func (s *HandshakeSecret) ClientHandshakeTraff(transcript hash.Hash) []byte { return deriveSecret(s.hash, s.secret, clientHandshakeTraff, transcript) } // ServerHandshakeTraff derives the server_handshake_traffic_secret from // the handshake secret and the transcript up to the ServerHello. func (s *HandshakeSecret) ServerHandshakeTraff(transcript...

   * long, streams created while we await the pong will reuse broken connections and inevitably
   * fail. If it is too short, slow connections will be marked as failed and extra TCP and TLS
   * handshakes will be required.
   *
   * The deadline is currently hardcoded. We may make this configurable in the future!
   */
  internal fun sendDegradedPingLater() {
    withLock {

hash: s.hash, } } // ClientHandshakeTraff derives the client_handshake_traffic_secret from // the handshake secret and the transcript up to the ServerHello. func (s *HandshakeSecret) ClientHandshakeTraff(transcript fips140.Hash) []byte { return deriveSecret(s.hash, s.secret, clientHandshakeTraff, transcript) } // ServerHandshakeTraff derives the server_handshake_traffic_secret from // the handshake secret and the transcript up to the ServerHello. func (s *HandshakeSecret) ServerHandshakeTraff(transcript...