Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Unit - 5 Chap – 3 SSL

Creating a Secure Server with SSL Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Creating a Secure Server with SSL The Internet is a much less secure place than it used to be. If the Web site you administer will be used for electronic commerce or for exchanging any type of information that needs to kept private, these transactions need to be secure. SSL-enabled Web sites use a different URL prefix, https, to indicate that HTTP protocol request and document transfers are encrypted.

and how to create a self-signed certificate. Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Secure Sockets Layer (SSL) is used to encrypt communications between your Web server and Web clients. It gives an overview of SSL, describes how digital certificates fit into the security picture, and how to create a self-signed certificate.

Understanding SSL and Server Certificates Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Understanding SSL and Server Certificates One key is public, accessible to everyone; the other key is private, so only you or another authorized person can access it. Either key can be used to encrypt or decrypt data. The public key is part of the certificate, which is how the certificate is used to verify data sent to and received from the server.

Understanding SSL and Server Certificates Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Understanding SSL and Server Certificates If a key is public, if (theoretically) everyone knows the public key, how can it be used for secure communication? Data encrypted with the public key can be decrypted only with the private key, which only you know. So, anyone can send you data encrypted with the public key but only you will be able to decrypt it because only you know the private key.

Understanding SSL and Server Certificates Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Understanding SSL and Server Certificates Likewise, data encrypted with your private key can be decrypted only by the public key. If only you know the private key, recipients of encrypted data can be confident that a message or other data has come from you and not from someone impersonating you.

Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Digital certificates Digital certificates work on two simple principles, encryption and trust: 1. SSL encrypts the communication between a Web server and a Web client to ensure that the data exchange has not been altered during transmission and to make it more difficult to steal sensitive data if the data exchange is intercepted. Encryption increases the difficulty of deciphering a captured data stream.

Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Digital certificates Digital certificates provide a certain level of assurance, or trust, that the identities behind a Web server and a Web client are genuine, that is, that a Web server or client is not being operated by an impostor or fraud. Depending on the type of certificate in use, a digital certificate issued by a recognized and trusted certificate authority (CA) means that the CA has taken steps to verify the identity of the organization or entity operating a Web site. As a result, a digital certificate provides a reasonable degree of certainty that a Web site is in fact operated by the organization or entity that claims to operate it.

Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Digital certificates A certificate contains information about the certificate owner, including the following: The owner’s email address The owner’s name How the certificate can be used How long the certificate is valid The address of the Web site for which the certificate has been issued The public key associated with the certificate A message digest (also known as hash) to use to confirm that the certificate has not been altered since it was issued

Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Creating a Self-Signed Certificate Creating a self-signed digital certificate on Fedora Core and RHEL systems is simple and straightforward. Use the following procedure (as the root user): 1. Change directories to /etc/pki/tls/certs: # cd /etc/pki/tls/certs 2. Create a key pair: # make genkey umask 77 ; \ /usr/bin/openssl genrsa -des3 1024 > /etc/pki/tls/private/localhost.key Generating RSA private key, 1024 bit long modulus ...............++++++ .......++++++ e is 65537 (0x10001)

Verifying - Enter pass phrase: Created by : Ashish Shah, J.M. PATEL COLLEGE OF COMMERCE Enter pass phrase: Verifying - Enter pass phrase: This step creates public and private keys that will be used to encrypt and decrypt data streams sent to and from the server. Use a pass phrase that will be easy to remember but difficult for others to guess. The generated key file will be /etc/pki/tls/private/localhost.key. 3. If you are going to obtain a digital certification from a CA, you need to create a certificate signing request (this step is optional for self-signed certificates): # make certreq umask 77 ; \ /usr/bin/openssl req -new -key /etc/pki/tls/private/localhost.key - out /etc/pki/tls/certs/localhost.csr Enter pass phrase for /etc/pki/tls/private/localhost.key: You are about to be asked to enter information that will be incorporated Configuring a Web Server 549