making https accessible (@dotsecurityio 2016)
Post on 14-Apr-2017
381 Views
Preview:
TRANSCRIPT
MAKINGHTTPS
ACCESSIBLE
THEACTORS
Certi cateAuthorityanentitytrustedbyclient(browser)installations.
Hostcreatesprivate&publickeypair,certi cate,andgetsitsignedbyaCAaftervalidationprocess.
Clientconnectsserver,downloadscerti cate,andchecksthatit'spreinstalledlistoftrustedCAs
containstheissuersignature.
WHYDOWENEEDITANYWAY?
MITMprotectionContentinjection
Sessionhijacking
Contentcensorship
HTTP/2
SEO
MajorbrowsersaregoingtomarkHTTPasinsecurechrome:// ags->Marknonsecureoriginsasnon-secure
WHAT'STHEPROBLEMTHEN?
ObtainingDVcerti catesisunnecessarilycumbersomeEverdoneit?You'llagree.
Avoidingitbyobtainingunnecessarywildcardcerts?
Moreimportantly:tediouscon guration-movingtarget
OHYEAHSSLProtocol all -SSLv2 -SSLv3SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHASSLHonorCipherOrder onSSLCompression off
SSLOptions +StrictRequire
WHAT'STHEPROBLEMTHEN?
ObtainingDVcerti catesisunnecessarilycumbersomeEverdoneit?You'llagree.
Avoidingitbyobtainingunnecessarywildcardcerts?
Moreimportantly:tediouscon guration-movingtarget
Repeattheaboveevery1/2/5years
Iflazy,skippingthecon gurationpart...Highpossibilityofinsecurecon guration.
REVOCATIONTOO.. .
CRLstandardisnotgoingtoworkChromefamilyofbrowsersalreadyignoringitinfavorofcuratedCRLSet.
We'replanningtoencryptthewholeweb,remember?
CA&THEOFFICIALCLIENT
LET'SENCRYPTCA
Free&OpenSource
SpeaksACMEprotocol
OnlyDV
Nowildcards,butupto100domainsinSAN
ChallengetypesDVSNI(tls-sni-01)
Nonceasvhostname
HTTP(http-01)
Customcontentin/.well-known/acme-challenge/nonce_ lename
DNS(dns-01)
NonceasTXTrecord
https://github.com/letsencrypt/boulder
https://tools.ietf.org/html/draft-ietf-acme-acme-02
SOMESTATISTICS, WHEREWEARE
NOW
Certi catesissuedby5thofApril2016:1,427,274
Outofwhich90,4%arenewtotheWebPKI!
StatisticsbyJ.C.Jones( ):
Certi catesissuedcurrently:2,010,081
Coveringroughly4milliondomains
Widevarietyofclients
@jamespugjones
https://tacticalsecret.com/124-days-of-lets-encrypt/
THEOFFICIALCLIENT
Authenticator/Installerpluginarchitecture
Savesyourcon gurationforrenewalRenewalworkssimplybyissuing:
Onsystemswithmultiplecerti cates,attemptstorenewonlyifneeded
Appendtocrontab� re&forget
$ letsencrypt renew
CURRENTCLIENTPLUGINS
ManualpluginExecutecommandstocompletethechallengemanually(inremotemachineforexample).
StandalonepluginStartinternalhttpdtorespondtohttp-01ortls-sni-01challenges
WebrootpluginUsealreadyrunninghttpdtoservechallengeresponsesfromde nedwebrootdirectory/
directories.
Apacheplugin(alsoappliestoexperimentalNGINXplugin)Readsyourconfuguration,andprompts(ifnotchosenbycliarguments)youtochoosefrom1to
100domainsfromthevhostsfound
Answerchallengesusingtls-sni-01
Con guresyourvhostswithnewlyacquiredcerti cates,andgooddefaults
Restartsservertoactivatethecon guration
Ifsomethingfails,willrollbackyourcon guration
THEDIRECTION
OCSPmust-staple
ClientnamechangeandmoveunderEFF
Con gurationmanagementKeepupwiththestate-of-the-artcon guration.
90dexpirationcomeshandy
WE'RESOLVINGEXACTLYWHAT?
It'scumbersometoaquirecerti catesLet'sEncryptCA+ACME+automation
Tediouscon gurationtheof cialclient
Methodsofrevocationinbadshape90dexpiry
OCSPMust-staple
THEFUTURE
Autonomouscerti categeneration&validationprocessbythe
serversoftwareitself
VerymuchachievableCheckoutCaddy:https://github.com/mholt/caddy
LINKS
Let'sEncrypt-
TheCA-
Theclient-
https://letsencrypt.org
https://github.com/letsencrypt/boulder
https://github.com/letsencrypt/letsencrypt
top related