How does SSL/TLS work? Describe the connection establishment process.

SSL/TLS establishes a secure connection between the client and server through several steps:

1. Client Hello: the client sends the server a set of supported TLS versions, cipher suites, a random number, and other parameters.

2. Server Hello: the server selects parameters (version, cipher), sends its random number, a certificate with a public key, and possibly a request for a client certificate.

3. Certificate verification: the client verifies the authenticity of the server's certificate, the trust chain, and the validity period.

4. Key exchange: depending on the chosen algorithm (e.g., RSA, Diffie-Hellman), the client and server exchange data to generate a shared secret key.

5. Session key generation: both parties use the exchanged data and random numbers to compute a shared symmetric key.

6. Finished: the client and server send each other messages with integrity checks, encrypted with the new key.

After this, a secure channel is established, and data is transmitted with encryption and integrity verification.

In Go, TLS is implemented in the crypto/tls package, which automates this process.