Implement SSL using PKI architecture to protect Web Access Security

Demonstration objectives:Use PKI architecture to protect Web Access Security SSL

Demo environment:As shown in figure 3.57.

Demo tool:The IIS component and certificate component integrated by Microsoft windows2003 server.

Demo steps:

Step 1:In this environment, you must first deploy 192.168.201.100 as the DNS and Web server in the network. The deployment of 192.168.201.100 is not the scope described in this book. Therefore, ask the instructor to demonstrate the entire deployment process, next, deploy the application as shown in section 3.4 Task 4: deploy the certificate server in the Microsoft independent environment and apply for and manage the independent Certificate Server described in the certificate, to issue certificates to Web servers in the environment. After completing the preceding configuration, you can see the effect of accessing the web server on the web Client as shown in Figure 3.58. Because the Web page is not encrypted, during transmission, you can use the protocol analyzer to capture the content on the Web page shown in Figure 3.59. if the content is the password of your bank card, it will be very insecure.

 

Note: The above description is the prerequisite environment for the entire experiment and is also the effect when Web access is not protected. The following steps use PKI to protect Web page access.

Step 2:The Web server requests a certificate from the Certificate Server. Note that the certificate requested by the Web server must be a computer certificate instead of a user certificate, because every user accessing the Web server must use the public key of the Web server. Now create a certificate application file on the Web server. First open the Directory Security tab of the site www.jinpei.com in the IIS component, as shown in Figure 3.60. Select the server certificate, click Next in the Web server certificate wizard shown in Figure 3.61, select create certificate in the dialog box shown in Figure 3.62, and then click Next. The prompt shown in Figure 6.63 appears. Select prepare certificate request now but send it later, in fact, this is the form of a certificate request application file, to prepare for the certificate application, and then the next step.

 

Enter the name and key length of the new certificate. Here, we use the FQDN of the Web site as the name of the new certificate, that is, www.jinpei.com and the default 1024-bit length of the key, of course, the length of the key is longer and safer, but the time for generating and generating the key will also be longer, as shown in Figure 3.64. Next, the dialog box shown in Figure 3.65 appears, the name and Department of the Organization must be entered. Please configure according to your actual situation. The configuration content here is 3.65, and then proceed.

The "Configure public site name" dialog box is displayed, as shown in Figure 3.66. In this dialog box, enter the DNS name of your site, which is www.jinpei.com in this environment, when you use a certificate, an error message indicating that the certificate does not match the public name may appear. Next, the dialog box shown in Figure 3.67 is displayed, requesting that you enter the geographical information of the Certificate Authority. In this process, Please configure according to the actual situation of your certificate authority. Next step. A message indicating the location of the requested file is displayed, as shown in Figure 3.68. You can retain the default location. Next, the dialog box shown in Figure 3.69 appears, all the summary messages in the previous configuration application file are displayed. If you have no errors, click Next. As shown in figure 3.70, the certificate application file is created successfully. You can view a certreq.txt file in the root directory of the C drive. This file is the certificate application file you have created, as shown in Figure 3.71.

 

 

Note: It is worth noting that the above configuration application file is to apply for a machine certificate for the Web server!

Step 3:Now, configure to formally submit a certificate application. First, you must enter the Certificate Application URL name in IE, http: // 192.168..1 .1/certsrv. When the Certificate Application page appears, select apply for a certificate, on the page shown in Figure 3.72, select Advanced Certificate application. On the page displayed in 3.73, select the base64 encoded CMC or PKCS #10 file to submit a certificate application. Next step.

About base64 encoded CMC or PKCS #10:

It is a certificate application format, or the application message can be saved in this format. This option is useful when the certificate authority cannot process the certificate application online, this is the case when the Web server in the demo environment applies for a certificate. You need to save the request as base64 encoded CMC or PKCS #10 standard.

The contents of the hosts file are all copied to the Save Application List, and then submitted. The risk prompt shown in Figure 3.75 is displayed. Select Yes. Then, the request in Figure 3.76 has been sent to the issuing authority, then wait for the CA administrator to review and reset. The certificate application has been submitted.

Step 4:Go to the configuration host to go To the CA server and open the certificate console on the CA server, as shown in Figure 3.77. You can see that there is a suspended certificate, that is, the Web server certificate application just now, after checking that the certificate is correct, identify the certificate request sent by the Web server, and then select and issue the suspended certificate.

Step 5:After the CA administrator issues a certificate to the Web server, we can go to the Web server again, open the Certificate Application page, and view the suspended certificate, as shown in Figure 3.78, you can see the certificate issued by the CA administrator. After you select the certificate, the page shown in Figure 3.79 appears. Select Download Certificate in DER encoding format.

 

About DER encoding format:

It is defined by the ITU-T Recommendation X.509, and its goal is to provide a way of coding objects (certificates and messages) on an independent platform, so that tokens can be transferred between devices and applications, it is a very strict encoding standard. In the process of certificate encoding, most applications use DER because the certificate request information must be encoded by DER and signed. Even if you are not using the Microsoft Certificate platform, other certificate platforms may also use this format because it supports compatibility and interoperability.

 

About base64 encoding format:

This encoding format is generally used for secure multi-purpose Internet Mail Extensions (S/MIME ). The certificate mainly applies this encoding format to e-mail. Its goal is to encode the file into a pure ASCII format, which can reduce the file access through Interenet (unreliable network) the probability of being corrupted during transmission. As long as clients that comply with the MIME standard can decode Base64 files, many non-Microsoft operating systems also support its applications.

After the download is completed, the download process shown in Figure 3.80 is displayed. After the download is completed, you can open the certificate, as shown in Figure 3.81. A problem occurs, this certificate on your Web server is not trusted because the root certificate of the Certificate Authority (in fact, the certificate chain of the CA) has not been downloaded by you, therefore, your Web server cannot determine whether the current certificate is issued by a trusted Certificate Authority.

 

At this point, you should visit the Certificate Application page on the Web server, as shown in Figure 3.82, select to download a CA certificate, certificate chain, and CRL. On the page shown in Figure 3.83, select to install the CA certificate chain. As shown in figure 3.84 and figure 3.85, select YES to install the CA certificate and certificate chain.

Check the certificate again and find that the certificate has been trusted, as shown in Figure 3.86. Go back to the security Directory tab of the corresponding website (www.jinpei.com) on the Web server, and start to use the Web server certificate wizard, as shown in Figure 3.87. Select next, in the displayed dialog box 3.88, select to process the pending request and install the certificate, and then go to the next step. Now you need to load the certificate for the Web server. navigate to the certificate download location, as shown in Figure 3.89. After determining the certificate location, select next.

 

 

As shown in figure 3.90, It is prompted that SSL can be used to protect the security of the web page, and the SSL port number must be specified. Keep the default 443. Then select next. The dialog box shown in Figure 3.91 is displayed, prompting you to install all the summary messages you have configured before, and select next. Install the certificate on the Web server, as shown in Figure 3.92. This completes the installation of the certificate on the Web server.

Now you can configure the Directory Security tab of the Web site www.jinpei.com and select Edit. In the dialog box shown in Figure 3.93, select require secure channel (SSL) to have 128-bit encryption, then you can ignore the client certificate or accept the client certificate. The meaning of the certificate and client options is as follows:

 

The options of customer and certificate are as follows:

ÜIgnore client certificates:Indicates that no certificate is required for the client. In this case, the client only uses the public key of the Web server to encrypt data, but the client does not need to send its own public key to the Web server.

ÜAccept client certificate:If the client provides a certificate, the Web server can accept the client certificate and use the client's public key, but does not emphasize that the customer must use the certificate, if the certificate server can accept. In many cases, this is the most common usage.

ÜClient certificate required:This option indicates that the customer must use the certificate. In other words, the Web server must use the client's public key to complete related security tasks. If this option is selected and the client does not provide a certificate, the server rejects the session with it.

Step 6:Now come to the client to securely access www.jinpei.com through SSL, at this time in IE should enter https://www.jinpei.com rather than http: // www/jinpei.com. After entering the information, a message indicating the connection to the Security page is displayed, as shown in Figure 3.94. Click OK.

The security prompt shown in Figure 3.95 is displayed. Note that there is a yellow exclamation point indicating that the book is issued by a company you have not chosen to trust. In other words, you do not trust the certificate currently in use. When you click View certificate in the prompt, you will see the Certificate Status shown in 3.96, indicating that the certificate is untrusted.

In fact, the reason for this phenomenon is very simple: because you do not trust the CA that issues a certificate to the Web server, you must not trust the certificate issued by the CA, so the so-called third-party Trust organizations have not been formed, and now it is true that the current situation is that the Web server trusts the CA, and you do not trust the CA, you won't trust the public key from the Web server. To solve this problem, you just need to download the certificate chain of the Certificate Server CA, as shown in 3.97, select to download a CA certificate, certificate chain, or CRL.

 

After the download of the CA certificate chain is complete, enter again in IE: The https://www.jinpei.com will not prompt any errors except for a secure connection, as shown in Figure 3.98, A small lock icon in the lower right corner of the browser indicates that the page is encrypted and encrypted using the public key of the Web server. If a third-party interceptor captures the data frame accessing the Web again, the data frame shown in Figure 3.99 is obtained. You can see that the data frame is encrypted by SSLv3, and the page content cannot be obtained again.