1. Secure Sockets Layer (SSL) Fred Schank Kevin Wetter

2. Introduction SSL – Where does it fit in? SSL – Where does it fit in? SSL Handshake Process SSL Handshake Process Handling Certificates Handling Certificates Example Example

3. SSL Non-secure request Secure request

4. Ciphers No encryption No encryption Stream Ciphers Stream Ciphers RC4 with 40-bit keys RC4 with 40-bit keys RC4 with 128-bit keys RC4 with 128-bit keys CBC Block Ciphers RC2 with 40 bit key DES with 40 bit key DES with 56 bit key Triple-DES with 168 bit key Idea (128 bit key) Fortezza (96 bit key)

5. SSL Handshake

6. Certificates Digital form of identifying a node Digital form of identifying a node Comprised of: Comprised of: Location Info Location Info Name Info Name Info Fingerprint Info Fingerprint Info CA Info CA Info

7. Certificate Authorities (CA’s) Issues certificates to “trusted” sites for a fee Issues certificates to “trusted” sites for a fee Common CA’s Common CA’s Verisign Verisign InterSSL InterSSL WorldTrust WorldTrust NOTE: Anyone can act as a CA NOTE: Anyone can act as a CA popular browsers only trust certain CA’s popular browsers only trust certain CA’s

8. Issuing a Certificate Create a “request for signing”: Create a “request for signing”: #> openssl req -new > new.cert.csr #> openssl req -new > new.cert.csr Remove passphrase from key: Remove passphrase from key: #> openssl rsa -in privkey.pem -out new.cert.key #> openssl rsa -in privkey.pem -out new.cert.key Sign the certificate: Sign the certificate: #> openssl x509 -in new.cert.csr -out new.cert.cert -req -signkey new.cert.key -days 365 #> openssl x509 -in new.cert.csr -out new.cert.cert -req -signkey new.cert.key -days 365

9. Configuring Apache /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf SSL config file for Apache SSL config file for Apache Changes Changes SSLCertificateFile /etc/httpd/conf/ssl.crt/new.cert.cert SSLCertificateFile /etc/httpd/conf/ssl.crt/new.cert.cert Specifies where server’s certificate is Specifies where server’s certificate is SSLCertificateKeyFile /etc/httpd/conf/ssl.crt/new.cert.key SSLCertificateKeyFile /etc/httpd/conf/ssl.crt/new.cert.key Specifies where server’s private key is Specifies where server’s private key is

10. Example http://134.198.161.101