Upgrade to Pro — share decks privately, control downloads, hide ads and more …

http httpsの違いについて

5059d3f370ad7e1f4d8de4be79ae1a2c?s=47 rvirus0817
November 21, 2014

http httpsの違いについて

5059d3f370ad7e1f4d8de4be79ae1a2c?s=128

rvirus0817

November 21, 2014
Tweet

Transcript

  1. http httpsͷҧ͍ʹ͍ͭͯ גࣜձࣾωοτΞγετ
 ҆ୡ ྋ

  2. ΞδΣϯμ • SSLͱ͸ • SSLͷྺ࢙ • SSL҉߸Խ௨৴ͷྲྀΕ/ূ໌ॻͷ࡞Γํ • OSIࢀরϞσϧʹ͓͚ΔSSLϓϩτίϧ •

    OSIࢀরϞσϧͱ͸ • OpenSSL֓ཁ • httpɺhttps֓ཁɺ࢓૊Έ • ·ͱΊ
  3. SSLͱ͸ • SSL/https (Secure Sockets Layer) • σʔλΛ҉߸Խ • ݸਓ৘ใ΍ΫϨδοτΧʔυ৘ใͳͲΛ҉

    ߸Խɹ • σʔλվ͟Μ΍ͳΓ͢·͠Λ๷͛Δ • 2017೥͔ΒશͯͷαΠτඞਢ 3
  4. SSLͷྺ࢙ • SSL 1.0→࠷ॳͷόʔδϣϯɺେ͖ͳ੬ऑੑ • SSL 2.0→1994೥ൃද • SSL 3.0→1995೥ൃදɺ2014೥10݄ʹେ͖ͳ੬ऑੑ

    • TLS 1.0→1996೥IETFͷTLSϫʔΩϯάάϧʔϓRFC 2246ͱ ͯ͠TLS1.0Λެද • TLS 1.1→2006೥ʹRFC 4346ͱͯ͠TLS 1.1੍͕ఆ • TLS 1.2→2008೥8݄ʹRFC 5246ͱͯ͠TLS 1.2੍͕ఆ • TLS 1.3→(૲ߘʣ2014೥10݄ʹ੍ఆ 4
  5. SSL҉߸Խ௨৴ͷྲྀΕ 5

  6. SSLαʔόূ໌ॻͷ࡞Γํ part1 6

  7. SSLαʔόূ໌ॻͷ࡞Γํ part2 7

  8. OSIࢀরϞσϧʹ͓͚ΔSSLϓϩτίϧ 8

  9. OSIࢀরϞσϧͱ͸ 9

  10. Open SSLͱ͸ • The Open Source toolkit for SSL/TLSͷུɻ •

    ιϑτ΢ΣΞ • 伴ͷੜ੒ɺূ໌ॻͷൃߦͱ؅ཧ • ੬ऑੑ͕ग़ͨ৔߹ɺΞοϓσʔτ 10
  11. http httpsͱ͸ • ʮhttpʯ͸ʮHyperText Transfer Protocolʯͷུ
 ΢Σϒαʔόʔͱωοτܦ༝ͰςΩετ΍ը૾ɺಈըͳͲ֤ छ৘ใΛަ׵͢ΔͨΊͷ௨৴ϧʔϧ • ʮhttpsʯ͸ʮHTTP

    over SSL/TLSʯͷུ
 ΍ΓऔΓ్͕தͰ౪ௌ͞Εͳ͍Α͏ʹσʔλΛ҉߸Խͨ͠ Γɺ௨৴૬खΛূ໌ͯ҆͠શʹ௨৴͢ΔͨΊʹ࢖ΘΕΔ
  12. httpͷྺ࢙ • ςΟϜɾόʔφʔζʹϦʔ • ϩόʔτɾΧΠϦϡʔ • 1990೥຤ • ॳͷWebϒϥ΢βͱWebαʔό 12

  13. http/https࢓૊Έ 13

  14. https࢖༻ྫ • 伴ΞΠίϯΛԡ͢ͱೝূͷ৘ใ͕ग़Δ 14

  15. 2016೥4݄ • Let's Encrypt • TLSͷX.509ূ໌ॻͷൃߦΛແྉͰൃߦ
 →ެ։伴ূ໌ॻͷඪ४ܗࣜ΍ূ໌ॻύεݕ ূΞϧΰϦζϜͳͲ • ߴηΩϡΞͳূ໌ॻ

    • 2018೥͔ΒϫΠϧυΧʔυ΋ 15
  16. ·ͱΊ • ϝϦοτ
 →҆શੑͷڧԽ • σϝϦοτ
 →අ༻͕͔͔Δ→ࠓ͸ແྉ
 →௨৴ྔ͕ଟ͘ͳΔ→஗͍ 16