module 5 tls and ssl n.
Skip this Video
Download Presentation
Module 5: TLS and SSL

Loading in 2 Seconds...

play fullscreen
1 / 36

Module 5: TLS and SSL - PowerPoint PPT Presentation

  • Uploaded on

Module 5: TLS and SSL. Overview. Transport Layer Security Overview Secure Socket Layer Overview SSL Termination SSL in the Hosted Environment Load Balanced SSL Setting up SSL in a Load Balanced Environment. Transport Layer Security Overview. Transport Layer Security.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Module 5: TLS and SSL' - mayda

Download Now An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
  • Transport Layer Security Overview
  • Secure Socket Layer Overview
  • SSL Termination
  • SSL in the Hosted Environment
  • Load Balanced SSL
  • Setting up SSL in a Load Balanced Environment
transport layer security
Transport Layer Security
  • Transport Layer Security (TLS) and its predecessor, Secure SocketsLayer (SSL), are cryptographic protocols that "provide communications security over the Internet".
  • TLS and SSL encrypt the segments of network connections above the Transport Layer, using symmetric cryptography for privacy and a keyed message authentication code for message reliability.
  • Several versions of the protocols are in widespread use in applications like web browsing, electronic mail, Internet faxing, instant messaging and voice-over-IP (VoIP).
  • The TLS protocol allows client/server applications to communicate across a network in a way designed to prevent eavesdropping and tampering.
  • A TLS client and server negotiate a stateful connection by using a handshaking procedure. During this handshake, the client and server agree on various parameters used to establish the connection's security.
  • The handshake begins when a client connects to a TLS-enabled server requesting a secure connection, and presents a list of supported CipherSuites (ciphers and hash functions).

TLS/SSL have a variety of security measures:

  • Protection against a downgrade of the protocol to a previous (less secure) version or a weaker cipher suite.
  • The message that ends the handshake ("Finished") sends a hash of all the exchanged handshake messages seen by both parties.
  • SSL v3 improved upon SSL v2 by adding SHA-1 based ciphers, and support for certificate authentication.
secure socket layer
Secure Socket layer
  • SSL (secure socket layer) is an encryption protocol created by Netscape to implement secure web transactions on port 443 (the unsecure default port is 80)
  • Today SSL goes by the name TLS (transport layer security) and is used in many other places like communicating with a POP3 server over port 995 (the unsecure default port is 110)
secure socket layer1
Secure Socket layer

With the evolution of e-business, data security has become very important for Internet users. The Secure Socket Layer (SSL) protocol ensures that the transfer of sensitive information over the Internet is secure. SSL protects information from:

  • Internet eavesdropping
  • Data theft
  • Traffic analysis
  • Data modification
  • Trojan horse browser /server
secure socket layer2
Secure Socket layer

The SSL protocol consists of server authentication, client authentication (optional but strongly recommended) followed by an encrypted conversation. The following scenario steps through the SSL process.

  • Server authentication
  • Client authentication
  • SSL handshake
secure socket layer3
Secure Socket layer
  • On an OpenVMS system you could find SSL in two locations depending upon your setup:
  • Under Apache/SWS (Secure Web Server) if you have installed it. (it has its own CERT TOOL)
  • As a standalone product if you have installed it. (This is automatically installed with OpenVMS 8.3 and higher)Use thE DCL command to check for it on your system:
ssl termination
SSL Termination
  • SSL termination in a CSS occurs when an SSL module, acting as a proxy server, terminates an SSL connection from a client, and then establishes a TCP connection to a server.
  • When the module terminates the SSL connection, it decrypts the data and sends the data as clear text to the CSS for a decision on load balancing.
  • The CSS transmits the data as clear text either to an HTTP server or back to the SSL module for encryption to a configured back-end SSL server.
ssl termination1
SSL Termination
  • An SSL proxy list determines the flow of SSL information between the SSL module, the client, and the server. An SSL proxy list comprises one or more virtual SSL servers (related by index entry).
  • An SSL module in the CSS uses the virtual SSL servers to properly process and terminate SSL communications between the client and the server.
  • You can define a maximum of 256 virtual SSL servers for a single SSL proxy list.
ssl termination2
SSL Termination
  • After you create and configure the entries in a proxy list, you must activate the list, and then add the SSL proxy list to a service to initiate the transfer of SSL configuration data to the SSL module.
  • When you activate the service, the CSS transfers the data to the module. Then you can add each SSL service to an SSL content rule.
ssl in the hosted environment
SSL in the Hosted Environment
  • If you are using SSL, use a unique IP address for each hosted organization. To use this configuration, you must bind the IP address to the xSPServer1.
  • The figure in the next slide shows xSPserver2 supporting three hosted organizations, each with its own unique IP address.
load balanced ssl
Load Balanced SSL
  • SSL applications can be a heavy burden on the resources of a Web Server, especially on the CPU and the end users may see a slow response
  • To resolve these kinds of issues, a Load Balancer capable of handling SSL Offloading in specialized hardware may be used
  • When Load Balancers are taking the SSL connections, the burden on the Web Servers is reduced and performance will not degrade for the end users.
This Diagram describes the procedure to set up the cluster and enable reverse proxy to support load-balancing of HTTP requests.