OpenSSL Cookbook by Ristić, Ivan -- Read -- Imperial Library of Trantor

Index

Preface

Feedback About Bulletproof SSL/TLS and PKI About the Author

1. OpenSSL Cookbook

Getting Started

Determine OpenSSL Version and Configuration Building OpenSSL Examine Available Commands Building a Trust Store

Conversion Using Perl Conversion Using Go

Key and Certificate Management

Key Generation Creating Certificate Signing Requests Creating CSRs from Existing Certificates Unattended CSR Generation Signing Your Own Certificates Creating Certificates Valid for Multiple Hostnames Examining Certificates Key and Certificate Conversion

PEM and DER Conversion PKCS#12 (PFX) Conversion PKCS#7 Conversion

Configuration

Cipher Suite Selection

Obtaining the List of Supported Suites Keywords Combining Keywords Building Cipher Suite Lists Keyword Modifiers

Sorting

Handling Errors Putting It All Together

Performance

A. SSL/TLS Deployment Best Practices

Introduction 1. Private Key and Certificate

1.1. Use 2048-bit Private Keys 1.2. Protect Private Keys 1.3. Ensure Sufficient Hostname Coverage 1.4. Obtain Certificates from a Reliable CA

2. Configuration

2.1. Deploy with Complete and Valid Certificate Chains 2.2. Use Only Secure Protocols 2.3. Use Only Secure Cipher Suites 2.4. Control Cipher Suite Selection 2.5. Support Forward Secrecy 2.6. Disable Client-Initiated Renegotiation 2.7. Mitigate Known Problems

3. Performance

3.1. Do Not Use Too-Strong Private Keys 3.2. Ensure That Session Resumption Works Correctly 3.3. Use Persistent Connections (HTTP) 3.4. Enable Caching of Public Resources (HTTP)

4. Application Design (HTTP)

4.1. Encrypt 100% of Your Web Site 4.2. Avoid Mixed Content 4.3. Understand and Acknowledge Third-Party Trust 4.4. Secure Cookies 4.5. Deploy HTTP Strict Transport Security 4.6. Disable Caching of Sensitive Content 4.7. Ensure That There Are No Other Vulnerabilities

5. Validation 6. Advanced Topics Changes

Version 1.3 (17 September 2013)

Acknowledgments About SSL Labs About Qualys

B. Changes

v1.0 (May 2013) v1.1 (October 2013)