SSL Deployment Best Practices

Short talk for Ruby Usergroup Hamburg 2014 about how to deploy SSL certificates while avoiding the most common pitfalls.

Transcript

1. SSL Deployment
   Best Practices
   Jan Krutisch
   Ruby Usergroup Hamburg
   https://jan.krutisch.de/
   PGP-Key: A3E52A33
   CF40 36B2 DBC8 83BA 29F1 3745 D400 34B1 A3E5 2A33
   

   View Slide

2. SSL? TLS?
   

   View Slide

3. Source: http://wiki.linuxwall.info/doku.php/en:ressources:dossiers:voip:tls_sips_rtps
   

   View Slide

4. Certificates
   

   View Slide

5. Free
   Not free
   Self signed
   CACert
   Commercial
   

   View Slide

6. Self signed
   

   View Slide

7. Security
   vs.
   Trust
   

   View Slide

8. View Slide

9. Let’s go shopping
   http://www.flickr.com/photos/prozla/4937459350/
   

   View Slide

10. View Slide

11. Deployment
    

    View Slide

12. TL;DR version
    

    View Slide

13. Apache
    

    View Slide

14. SSLEngine on
    SSLCertificateFile /etc/ssl/private/cert.crt
    SSLCertificateKeyFile /etc/ssl/private/private_key.key
    !
    SSLCertificateChainFile /etc/apache2/ssl.crt/chain.crt
    

    View Slide

15. Nginx
    

    View Slide

16. ssl on;
    ssl_certificate /etc/ssl/certs/ssl-bundle.crt;
    ssl_certificate_key /etc/ssl/private/private_key.key;
    

    View Slide

17. Test!
    

    View Slide

18. https://www.ssllabs.com/ssltest/
    

    View Slide

19. https://www.ssllabs.com/ssltest/
    Dafuq?!?
    

    View Slide

20. View Slide

21. Common issues
    

    View Slide

22. Common issues
    according to my story
    

    View Slide

23. Cert Chain
    

    View Slide

24. View Slide

25. Cipher Suites
    

    View Slide

26. RC4 vs. BEAST
    

    View Slide

27. TLS compression
    (CRIME)
    

    View Slide

28. BREACH?
    

    View Slide

29. Forward Secrecy
    

    View Slide

30. EDH vs. EECDH
    

    View Slide

31. Ephemeral
    (Elliptic Curve)
    Diffie Hellman
    

    View Slide

32. # Apache
    SSLProtocol all -SSLv2 -SSLv3
    SSLHonorCipherOrder on
    SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
    EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
    EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"
    !
    # Nginx
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
    EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
    EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
    https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
    

    View Slide

33. View Slide

34. Bam!
    

    View Slide

35. Domains vs. IPs
    

    View Slide

36. Server Name
    Indication
    

    View Slide

37. View Slide

38. View Slide