> but does the kernel then also do certificate validation for you No, the asymmetric cryptography is all done in userspace. Then, post-handshake, symmetric cr

> but does the kernel then also do certificate validation for you No, the asymmetric cryptography is all done in userspace. Then, post-handshake, symmetric cryptography (e.g., AES) is done in-kernel. This is the same way it works with TCP if you’re using kTLS.