Effecient Ways of Implementation Secure HTTP in Microservices

Presented at .NET Konf 2019 (Devnot Organization). It's about how to use SSL Passthrough and SSL Termination on dockerized .NET Core applications are running on Kubernetes.

Transcript

1. Effecient Ways of Implementation Secure HTTP in Microservices
2. SELÇUK USTA Software Development Manager @ /in/selcukusta selcukusta.com selcukusta ustasoglu selcukusta (at)gmail.com
3. I’M DEVELOPER AND … NOT MY JOB! I’M SYSADMIN AND … NOT MY JOB!
4. I’M WITH YOU ’TİL THE END OF THE DEPLOYMENT!
6. WE’RE THE TEAM AND SOFTWARE DELIVERY IS OUR JOB!
7. ..but…
8. I’ve to learn; OS-level dependencies Computer networking Application topologies New development trends Monitoring and tracing Network & application security As a developer
9. I’ve to learn; OS-level dependencies Computer networking Application topologies New development trends Monitoring and tracing Network & application security As a developer
10. SSL TLS
11. SSL 1.0 (1994)
12. SSL 1.0 (1994) SSL 2.0 (1995)
13. SSL 1.0 (1994) SSL 2.0 (1995) SSL 3.0 (1996)
14. SSL 1.0 (1994) SSL 2.0 (1995) SSL 3.0 (1996) TLS 1.0 (1999)
15. SSL 1.0 (1994) SSL 2.0 (1995) SSL 3.0 (1996) TLS 1.0 (1999) TLS 1.1 (2006)
16. SSL 1.0 (1994) SSL 2.0 (1995) SSL 3.0 (1996) TLS 1.0 (1999) TLS 1.1 (2006) TLS 1.2 (2008)
17. SSL 1.0 (1994) SSL 2.0 (1995) SSL 3.0 (1996) TLS 1.0 (1999) TLS 1.1 (2006) TLS 1.2 (2008) TLS 1.3 (2018) SSL deprecated (2015) Browser supports TLS 1.2 (2013)
18. ..so…
19. SSL is the history of TLS and now it’s deprecated
20. ..and…
21. SSL and TLS use the same standard digital certificates
22. SSLOffloading Passthrough
23. -> create certificate request on web server -> get certificate from provider -> complete certificate request on web server -> set bindings
26. When an incoming secure HTTP request is not decrypted at the load balancer, the data is passed along to the backend server for decryption.
27. When an incoming secure HTTP request is not decrypted at the load balancer, the data is passed along to the backend server for decryption. Web application security is top concern. (Banking, payment systems, data protection regulations, etc…)
28. When an incoming secure HTTP request is not decrypted at the load balancer, the data is passed along to the backend server for decryption. Web application security is top concern. (Banking, payment systems, data protection regulations, etc…) Not sure about the department/provider of network device management.
29. When an incoming secure HTTP request is not decrypted at the load balancer, the data is passed along to the backend server for decryption. Web application security is top concern. (Banking, payment systems, data protection regulations, etc…) Not sure about the department/provider of network device management. The security of data transfers within LAN is so important.
30. When an incoming secure HTTP request is not decrypted at the load balancer, the data is passed along to the backend server for decryption. Web application security is top concern. (Banking, payment systems, data protection regulations, etc…) Not sure about the department/provider of network device management. The security of data transfers within LAN is so important. Have more, much more, unlimited CPU. J
31. When an incoming secure HTTP request is decrypted at the load balancer, the data is passed along to the backend server as plain HTTP.
32. When an incoming secure HTTP request is decrypted at the load balancer, the data is passed along to the backend server as plain HTTP. OS-agnostic certificate management. (Web applications can be executed behind a variety of web servers, running on different operating systems)
33. When an incoming secure HTTP request is decrypted at the load balancer, the data is passed along to the backend server as plain HTTP. OS-agnostic certificate management. (Web applications can be executed behind a variety of web servers, running on different operating systems) Using load-balancing and proxy features limitless. (Inspect, manipulate and log the request objects before passing them)
34. When an incoming secure HTTP request is decrypted at the load balancer, the data is passed along to the backend server as plain HTTP. OS-agnostic certificate management. (Web applications can be executed behind a variety of web servers, running on different operating systems) Using load-balancing and proxy features limitless. (Inspect, manipulate and log the request objects before passing them) "x-forwarded-proto" header is so important, and"x-forwarded-host"! (If the backend application needs to say: "I’m coming from this hostname and with this protocol!")
35. ON AIR: “How to pass secure data to the .NET Core web application is running on Kubernetes?” /in/selcukusta selcukusta.com selcukusta ustasoglu selcukusta (at)gmail.com