Https pitfall and https pitfall

Https pitfall and https pitfall

Boss said that if we bought an authoritative certificate, we should do a full-site https, so that users can open the home page to see the trusted Green logo. So we started our journey.

[Only master domain, OK ?]

Not good... The console reports a large number of warnings because the image domain does not have https ~ The certificate symbol of the browser is not green ~

 

[Where to decrypt SSL ?]

The architecture of big websites is complicated ~ Load Balancing and dynamic/static separation at different layers ~ The most classic one is the separation of images and applications, which also causes us to configure certificates for two domains.

I have thought about NginX configuration. The advantage is that only one certificate is configured on one machine. The disadvantage is that the configuration of multiple machines is difficult to manage, so I had to configure it on the front HA layer ~

How to configure multiple online tutorials ~ The configuration points to a text file, which contains a list of domain names and certificates.

 

[How to test the environment ?]

Cold salad ~ Use openssl to generate several self-signed documents ~ Then manually import the data to the browser to enjoy the fun ~

Probably.
Http://www.centoscn.com/CentOS/config/2014/0220/2423.html

There are several key points:

1. At the beginning, the private key was password-protected, but it was generally used directly on the server. Therefore, the private key should be converted to password-protected.

2. The pem file is equal to: crt certificate + private key. Various international standards such as pem and X509 in the password system will not be launched. In short, there will be some organization information, keys, summaries, etc.

3. If you want to be lazy, you can sign it to *. Main domain. com, but you cannot step into the test environment in advance, and the multi-certificate situation will eventually be different.

4. Set the 400 permission for the key and certificate, which is not available in the production environment ~

 

[How about HSTS ?]

Of course, you should enable strict HSTS Transmission security for full-site https. You can convert http to https requests directly in the browser, instead of returning 301 for redirect.

However, if some pages do not have https yet, there is no way ~

 

[Why cannot I open the phone browser for a zombie certificate provider ?]

How is it possible that the certificate supplier is an authoritative organization, why is there no root certificate in Android? After investigation, it is found that the root certificate of the certificate vendor is indeed in Android. After several queries, we can find that you need to configure the ca-bundle certificate chain, that is, the dependency signed by the Trusted Root Certificate ~ Mobile browsers can also have fun ~

 

[How is your https security ?]

For example, Baidu's chestnuts (I don't know if the ip address is correct, not a.shifen.com ~)

Https://www.ssllabs.com/ssltest/analyze.html? D = baidu.com & s = 103.235.46.39

Our website is like this... The Shenma VIP dog vulnerability and the heartbleed vulnerability are all exposed ~ After reading a bunch of English warnings and saying something that can be exploited by man-in-the-middle attacks, there is actually one sentence at the end... Upgrade openssl to TSL...

Take a look at this article http://www.oschina.net/news/56159/ssl-v3-poodle

 

[Do you want to use SNI ?]

When I bought the CDN service, the cloud service provider asked if it was not supported by SNI? What is SNI? Server Name Indication is an extension of the TSL protocol. It is used to support binding multiple certificates to one IP address. Therefore, non-SNI is the compatibility of earlier browsers such as IE7... Please use modern browsers...

 

[Client error peer not authenticated]

The access from browsers, mobile phones, and general clients seems to be okay. However, access to a certain external system of tiankun becomes a problem... No certificate is installed on the Internet, but we are an authoritative certificate. How can this problem be solved ~

Then I wrote a simple httpclient call. It is normal for the server to initiate the call and the SSL error is reported when the call is started in IDE.

Check several times and confirm that the service runs normally in jdk1.7. If an error is reported in jdk1.6, The httpclient is 4.1.

Then two questions are raised: whether there are any bugs in httpclient or jdk, and whether the old jdk version uses the old SSL protocol, which is not allowed by the server.

This problem still has to be verified and remains to be resolved. You are welcome to give suggestions.

 

So far, it's almost like the whole site https is running ~ A lot of concepts and operation details will not be expanded one by one.

At last, I presented my analysis on the principle of SSL/TSL. The length is not long, but I want to explain the process of https handshake and communication.

Http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html