1 / 30

Apache and SSL

Apache and SSL. Presented by Paul Weinstein, Waubonsie Consulting, <pdw@waubonsie.com> O’Reilly Open Source Convention July 24, 2002. Hello World. Introduction What Will Be Covered Review of SSL Quick History of Apache and SSL Apache 1.3.x Apache 2.0.x Cool Tricks of Apache and SSL

pier
Download Presentation

Apache and SSL

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Apache and SSL Presented by Paul Weinstein, Waubonsie Consulting, <pdw@waubonsie.com> O’Reilly Open Source Convention July 24, 2002

  2. Hello World • Introduction • What Will Be Covered • Review of SSL • Quick History of Apache and SSL • Apache 1.3.x • Apache 2.0.x • Cool Tricks of Apache and SSL • What Won’t Be Covered

  3. Disclaimer It should be noted that this presentation does not cover all issues relating to securing networked based machines and their content. This presentation is designed only to introduce basic concepts and configuration of Apache and SSL.

  4. SSL and TLS: Secure Sockets Layer (SSL), developed by Netscape Communications, and Transport Layer Security (TLS), the open-standard replacement for SSL from the Internet Engineering Task Force, are the two protocols that add encryption and authentication to TCP/IP.

  5. SSL and TLS:Two Main Features • Ciphers; which enable the encryption of data between the client and server. • Digital Certificates; which provide a method of authentication of a client and server.

  6. SSL and TLS:Ciphers • Symmetric (a.k.a. Secret-Key) • Asymmetric (a.k.a. Public-Key)

  7. SSL and TLS:Digital Certificates • Advantage of Public-Key Encryption • Server Certificate • Client Certificate • Root Certificate • Certificate Authority • Public Certificate Authority • Private Certificate Authority

  8. Apache and SSL:A Timeline

  9. mod_ssl • Support for SSL v2, v3 and TLS v1 • Advance pass-phrase handling for private keys • X.509 based digital certificates, certificate generation, certificate revocation list • Support for crypto acceleration hardware * • Backward compatibility • * Platform Dependent

  10. mod_ssl • Most Popular SSL Solution for Apache • 1,098,542 of 4,577,603 or 23.99%* • Second Only to PHP and Perl Overall • 43.71% and 24.11%* • * Source: E-Soft June 2002 Report, <http://www.securityspace.com>

  11. Apache 1.3.x:mod_ssl • Integration • Needs EAPI • Can Build as a DSO • OpenSSL Toolkit

  12. Apache 2.0.x:mod_ssl • Supports New Apache 2.0 Architecture • Included with the Apache 2.0.x source code • To add mod_ssl when building Apache • --enable-ssl • --with-ssl=/path/to/OpenSSL/lib

  13. Apache and SSL:Cool Tricks - The Ubiquitous Online Store Transacting of payment information for consumer good(s) in a secure manner between the customer and the business.

  14. Apache and SSL:Cool Tricks - The Ubiquitous Online Store • What We Need: • Enable mod_ssl • Request a server certificate from a public certificate authority • Install server certificate • Add a CGI script to collect data • Configure access to CGI script via HTTPS

  15. Apache and SSL:Cool Tricks - The Ubiquitous Online Store • What We Get:

  16. Apache and SSL:Cool Tricks - The Ubiquitous Online Store • What We Get: • The communication with the store is secure. • The server on the other end, decrypting the data is in fact the online store as identified by the server’s digital certificate and authenticated by a trusted third party.

  17. Apache and SSL:Cool Tricks - An Organization’s Intranet Transacting of organizational information in a secure manner between the organization’s groups and individuals.

  18. Apache and SSL:Cool Tricks - An Organization’s Intranet • What We Need: • Create a private certificate authority using OpenSSL • Enable mod_ssl • Request a server certificate from the private certificate authority • Install server certificate

  19. Apache and SSL:Cool Tricks - An Organization’s Intranet • What We Need: • Add a CGI script to collect data • Configure access to CGI script via HTTPS • Install private certificate authority's root certificate • Configure server to authenticate clients based on certificates from private certificate authority

  20. Apache and SSL:Cool Tricks - An Organization’s Intranet • What We Need: • Sign client certificate requests & install in client’s web browsers • Install private certificate authority’s root certificate • Authenticate servers based on private certificate authority

  21. Apache and SSL:Cool Tricks - An Organization’s Intranet • What We Get:

  22. Apache and SSL:Cool Tricks - An Organization’s Intranet • What We Get: • The communication within the organization is secure. • The server on one end is in fact organization’s server - the information from is valid. • The client on the other end is in fact a member of the organization - the information has not been compromised.

  23. Review of Apache and SSL • SSL and TLS • History of Apache and SSL • Apache 1.3.x • Apache 2.0.x • Cool Tricks of Apache and SSL

  24. Citation • Engelschall, Ralf User Manual mod_ssl Version 2.8 Jan. 2001 <http://www.modssl.org/docs/2.8> • mod_ssl: The Apache Interface to OpenSSL <http://www.modssl.org>

  25. Citation • Weinstein, Paul. "Web Security: Encryption & Authentication." Daemonnews (May 2001): 15 pars. <http://www.daemonnews.org/200105/ssl_apache.html> • Weinstein, Paul "Web Security: Apache and mod_ssl." Daemonnews (June 2001): 15 pars. <http://www.daemonnews.org/200106/ssl_apache_pt2.html>

  26. Suggested References • This Presentation: • Article: • Weinstein, Paul. “Apache and SSL” O’Reilly Network: ONLamp.com (April 2002): 24 pars. <http://www.onlamp.com/pub/a/onlamp/2002/04/18/ssl.html>

  27. Suggested References • This Presentation: • Slides: • <http://www.waubonsie.com> • <http://www.weinstein.org/work/presentations/oscon02/apache_ssl> (HTML) • <http://www.weinstein.org/work/presentations/oscon00/apache_ssl.pdf> (PDF)

  28. Suggested References • Apache Project, <http://www.apache.org> • Apache Week, <http://www.apacheweek.com>

  29. Suggested References • mod_ssl Project, <http://www.modssl.org> • Mailing Lists, List Archives: • <modssl-announce@modssl.org> • <modssl-users@modssl.org> • <http://marc.theaimsgroup.com/?l=apache-modssl>

  30. Suggested References • OpenSSL Project, <http://www.openssl.org> • Mailing Lists, List Archives: • <openssl-announce@openssl.org> • <http://marc.theaimsgroup.com/?l=apache-modssl> • <openssl-cvs@openssl.org> • <http://www.progressive-comp.com/Lists/?l=openssl-cvs> • <openssl-dev@openssl.org> • <http://www.progressive-comp.com/Lists/?l=openssl-dev> • <openssl-users@openssl.org> • <http://www.progressive-comp.com/Lists/?l=openssl-users>

More Related