[B! SSL] rin51ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

rin51 id:rin51

SSLã«é–¢ã™ã‚‹rin51ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (36)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Wireshark ã ã‘ã§ TLS ã‚’å¾©å·ã§ããŸã®ã§ã€ã‚‚ã†ä»–ã«ä½•ã‚‚ã„ã‚‰ãªã„ï¼ˆã‹ã‚‚ã—ã‚Œãªã„ï¼‰ - Qiita
ã¯ã˜ã‚ã« tcpdump ã‚„ Proxy ã‚’ä½¿ã‚ãšã« Wireshark ã ã‘ã§ TLS é€šä¿¡ã®å¾©å·ã«æˆåŠŸã—ã¾ã—ãŸã€‚ãŸãã•ã‚“ã®äººãŒåŒã˜ã‚ˆã†ãªã“ã¨ã‚’ã‚„ã£ã¦ã„ã¾ã™ãŒã€è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã¨ã—ã¦æ®‹ã—ã¦ãŠãã¾ã™ã€‚OS ã¯ Windows10 ã€ãƒ–ãƒ©ã‚¦ã‚¶ã¯ Chrome ã§ã™ã€‚ è¨å®šæ‰‹é † TLS ã§æš—å·åŒ–ã™ã‚‹éš›ã«ç”Ÿæˆã—ãŸéµæƒ…å ±ã‚’ãƒ•ã‚¡ã‚¤ãƒ«ã«å‡ºåŠ›ã™ã‚‹ Windowsã‚ãƒ¼ + R ã§ã€Œãƒ•ã‚¡ã‚¤ãƒ«åã‚’æŒ‡å®šã—ã¦å®Ÿè¡Œã€ç”»é¢ã‚’å‡ºã—ã€ã€Œcontrolã€ã¨å…¥åŠ›ã—ã¦ã€ŒOKã€ã‚’æŠ¼ã—ã¾ã™ã€‚ ã€Œã‚·ã‚¹ãƒ†ãƒ ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ ã€Œã‚·ã‚¹ãƒ†ãƒ ã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ ã€Œã‚·ã‚¹ãƒ†ãƒ ã®è©³ç´°è¨å®šã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ ã€Œè©³ç´°è¨å®šã€ã‚¿ãƒ– â†’ ã€Œç’°å¢ƒå¤‰æ•°ã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ ã€Œã‚·ã‚¹ãƒ†ãƒ ç’°å¢ƒå¤‰æ•°ã€ã®ã€Œæ–°è¦ã€ã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¾ã™ã€‚ ä»¥ä¸‹ã®ã‚ˆã†ã«å…¥åŠ›ã—ã¾ã™ã€‚ å¤‰æ•°åã€€SSLKEYLOGFILE å¤‰æ•°å€¤ã€€C:\temp\tls.keys å¤‰æ•°å€¤ã¯å˜åœ¨ã™ã‚‹ãƒ‘ã‚¹ãª
rin51 2023/10/14
HTTP

TLS

wireshark

SSL
ãƒªãƒ³ã‚¯
curlã‚³ãƒžãƒ³ãƒ‰ã®TLSé€šä¿¡ã‚’Wiresharkã§å¾©å·ã™ã‚‹ - Qiita
ã¯ã˜ã‚ã« HTTPSé€šä¿¡ã¯TLSã§æš—å·åŒ–ã•ã‚Œã‚‹ã®ã§ï¼Œãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã—ã¦ã‚‚æš—å·åŒ–å‰ã®é€šä¿¡ã¯è§£èªã§ãã¾ã›ã‚“ã€‚ãŸã ï¼ŒHTTPSé€šä¿¡ã®ä¸èº«ã‚’ã‚„ã£ã±ã‚Šè¦‹ã¦ã¿ãŸããªã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ã“ã®ã‚ˆã†ãªå ´åˆï¼Œå…±é€šéµï¼ˆã‚»ãƒƒã‚·ãƒ§ãƒ³éµï¼‰ã‚’curlã®æ©Ÿèƒ½ã§è¨˜éŒ²ã—ï¼ŒWiresharkã«å…±é€šéµã‚’èªè˜ã•ã›ã‚‹ã“ã¨ã§ï¼ŒTLSé€šä¿¡ã®å†…å®¹ã‚’è§£èªã§ãã¾ã™ã€‚ ãƒ†ã‚¹ãƒˆç’°å¢ƒ ã‚ãƒ£ãƒ—ãƒãƒ£å–å¾—ç’°å¢ƒ ubuntu22.04 curl 7.81.0 (x86_64-pc-linux-gnu) libcurl/7.81.0 OpenSSL/3.0.2 zlib/1.2.11 brotli/1.0.9 zstd/1.4.8 libidn2/2.3.2 libpsl/0.21.0 (+libidn2/2.3.2) libssh/0.9.6/openssl/zlib nghttp2/1.43.0 librtmp/2.3 OpenLDAP/2.5.14
rin51 2023/10/14
HTTP

TLS

SSL
ãƒªãƒ³ã‚¯
ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
rin51 2022/07/15
SSL

TLS
ãƒªãƒ³ã‚¯
ãƒ¬ã‚¬ã‚·ãƒ¼ã¨ãªã£ãŸ TLS 1.0/1.1 å»ƒæ¢ã¾ã§ã®é“ã®ã‚Š - ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰é–‹ç™ºè€…ãƒ–ãƒã‚°
SRE å…¼ã‚ˆã‚ãšå±‹ã® id:sora_h ã§ã™ã€‚æœ€è¿‘ã¯æœ¬ç¤¾ç§»è»¢ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‚’ã‚„ã£ã¦ã„ã¾ã™ã€‚è¶£å‘³ã¯ Web *1 ã§ã™ã€‚ ã•ã¦ã€ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰ã§ã¯ 2020 å¹´ 12 æœˆã« TLS 1.0 ãŠã‚ˆã³ TLS 1.1 (ä»¥å¾Œ "Legacy TLS") ã‚’å»ƒæ¢ã—ã¾ã—ãŸã€‚ Legacy TLS ã¯ RFC 7457 ã§ã¾ã¨ã‚ã‚‰ã‚Œã¦ã„ã‚‹ã‚ˆã†ãªæ—¢çŸ¥ã®è„†å¼±æ€§ã®å˜åœ¨ãªã©ã‹ã‚‰ã€Chrome, Firefox ã¨ã„ã£ãŸä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ã‚’å«ã‚å„æ‰€ã§ã®ã‚µãƒãƒ¼ãƒˆãŒæ‰“ã¡åˆ‡ã‚‰ã‚Œã¤ã¤ã‚ã‚Šã¾ã™ã€‚ã¾ãŸã€ç¾åœ¨ã§ã¯ IETF ã«ãŠã„ã¦ã‚‚ Legacy TLS ã¯ deprecated ã¨ RFC 8996 ã«ã¦å®£è¨€ã•ã‚Œã¾ã—ãŸã€‚ ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰ã§ã‚‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ãŠã‚ˆã³ãƒ¬ã‚¬ã‚·ãƒ¼ãªæŠ€è¡“ã¨å‘ãåˆã†ä¸€ç’°ã§å»ƒæ¢ã‚’é€²ã‚ã¾ã—ãŸã€‚æˆ‘ã€…ã¯æ´å²ã®é•·ã„ã‚µãƒ¼ãƒ“ã‚¹ã‚‚æä¾›ã—ã¦ã„ã‚‹ãŸã‚ã€å¤ã„ Android ã‚„ Internet Explorer ãªã©ã‹ã‚‰ã®ã‚¢ã‚¯ã‚»ã‚¹
rin51 2021/08/19
TLS

SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

cookpad

ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰
ãƒªãƒ³ã‚¯
ç„¡æ–™ã® SSL è¨¼æ˜Žæ›¸ãŒå¾—ã‚‰ã‚Œã‚‹ ZeroSSL ã‚’ä½¿ã£ã¦ã¿ãŸ
ã¯ã˜ã‚ã« çš†ã•ã‚“ã¯ ZeroSSL ã‚’çŸ¥ã£ã¦ã„ã¾ã™ã‹ï¼Ÿå€‹äººã§ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’é‹å–¶ã—ã¦ã„ã‚‹çš†ã•ã‚“ã§ã‚ã‚Œã°ã€å¤šãã®æ–¹ã¯ Let's Encrypt ã‚’åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ã€‚ https://letsencrypt.org/ja/ ã‚‚ã¡ã‚ã‚“åƒ•ã‚‚ä½¿ã£ã¦ã„ã¾ã™ã€‚åƒ•ã®æ§˜ãªã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æ–¹ã§ã‚ã‚Œã° SSL ã®ä»•çµ„ã¿ã‚‚ãŠãŠã‚ˆãç†è§£ã‚‚ã—ã¦ã„ã‚‹ã—ã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã®å®Ÿè¡Œæ–¹æ³•ã‚‚çŸ¥ã£ã¦ãŠã‚‰ã‚Œã‚‹ã®ã§ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã® SSL è¨¼æ˜Žæ›¸ã‚’å–å¾—ã™ã‚‹äº‹ã‚‚ãã‚Œã»ã©é›£ã—ã„äº‹ã§ã¯ãªã„ã§ã—ã‚‡ã†ã€‚ ã—ã‹ã—ãã‚Œã»ã©è©³ã—ããªã„æ–¹ãŒ certbot ã®æ§˜ãªã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦ SSL è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹ã®ã¯å‰²ã¨é›£ã—ã„äº‹ã§ã™ã€‚ãã“ã§ã”ç´¹ä»‹ã—ãŸã„ã®ãŒ ZeroSSL ã§ã™ã€‚ https://zerossl.com/ ZeroSSL ã¨ã¯ ZeroSSL ã‚‚ã¾ã ã‚ã¾ã‚Šåå‰ãŒçŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã›ã„ã‹ã€Google æ¤œç´¢ã§ã€ŒZeroSSLã€ã‚’æ¤œç´¢ã™ã‚‹ã¨ã€ŒZeroS
rin51 2020/12/05
SSL

JSON
ãƒªãƒ³ã‚¯
Wiresharkã«ã‚ˆã‚‹ãƒ‘ã‚±ãƒƒãƒˆè§£æžè¬›åº§ 8ï¼šHTTPSãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã®å¾©å·
This post is also available in: English (è‹±èªž) æ¦‚è¦ æœ¬ã‚·ãƒªãƒ¼ã‚ºã¯ã€ç–‘ã‚ã—ã„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¢ã‚¯ãƒ†ã‚£ãƒ“ãƒ†ã‚£ã®èª¿æŸ»ã‚„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã®ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ï¼ˆpcapï¼‰ã®ç¢ºèªã‚’æ¥å‹™ã§è¡Œã£ã¦ãŠã‚‰ã‚Œã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ã‚’èªè€…ã¨ã—ã¦æƒ³å®šã—ã¦ã„ã¾ã™ã€‚ã“ã®ãŸã‚æœ¬ç¨¿ã§ã®æ‰‹é †èª¬æ˜Žã¯èªè€…ã®çš†ã•ã‚“ãŒWiresharkã®ä½¿ã„ã‹ãŸã‚’ã”å˜çŸ¥ã§ã‚ã‚‹ã“ã¨ã‚’å‰æã¨ã—ã¦ã„ã¾ã™ã€‚ã¾ãŸã€æœ¬ç¨¿ã«ã¦åˆ©ç”¨ã™ã‚‹Wiresharkã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯ä¸»ã«3.xã¨ãªã‚Šã¾ã™ã€‚ æ˜¨ä»Šã€å¯¾è±¡ã¨ãªã‚‹ç–‘ã‚ã—ã„ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¢ã‚¯ãƒ†ã‚£ãƒ“ãƒ†ã‚£ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ãŒæš—å·åŒ–ã•ã‚Œã¦ã„ã‚‹ã“ã¨ã¯çã—ãã‚ã‚Šã¾ã›ã‚“ã€‚ä»Šã¯ã»ã¨ã‚“ã©ã®Webã‚µã‚¤ãƒˆãŒ Hypertext Transfer Protocol Secureï¼ˆHTTPSï¼‰ãƒ—ãƒãƒˆã‚³ãƒ«ã‚’ä½¿ç”¨ã—ã¦ãŠã‚Šã€ãã†ã—ãŸé€šå¸¸ã® Webã‚µã‚¤ãƒˆã¨åŒæ§˜ã«ã•ã¾ã–ã¾ãªãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚‚ã¾ãŸ HTTPS ã‚’åˆ©ç”¨ã—ã¦ã„ã¾
rin51 2020/08/24
HTTP

TLS

wireshark

SSL
ãƒªãƒ³ã‚¯
2020å¹´9æœˆã‚ˆã‚ŠAppleãŒSSLè¨¼æ˜Žæ›¸ã®æœ‰åŠ¹æœŸé–“ã‚’13ã‹æœˆã«çŸç¸®ï¼è©³ç´°ã‚„å¯¾ç–ã¨ã¯ï¼Ÿ | ã•ãã‚‰ã®SSL
ä»Šå¾ŒSafariã§èµ·ãã‚‹ã“ã¨ Safariã¨ã¯ã€Appleã§é–‹ç™ºã•ã‚Œã¦ã„ã‚‹Webãƒ–ãƒ©ã‚¦ã‚¶ã§ã‚ã‚Šã€ãƒ‘ã‚½ã‚³ãƒ³ã§ã‚ã‚‹Macã®ä»–ã«iPhoneã‚„iPadã€Apple TVã€Apple Watchãªã©ã®ç«¯æœ«ã«æ¨™æº–ã§æè¼‰ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã®Safariã«ãŠã„ã¦ã€2020å¹´9æœˆ1æ—¥ä»¥é™ã«ç™ºè¡Œã•ã‚ŒãŸã€Œæœ‰åŠ¹æœŸé–“ãŒ399æ—¥ä»¥ä¸Šã€ã®SSLã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ï¼ˆä»¥ä¸‹ã€SSLè¨¼æ˜Žæ›¸ï¼‰ãŒä¿¡é ¼ã•ã‚Œãªã„ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ å…·ä½“çš„ãªã‚¨ãƒ©ãƒ¼ç”»é¢ã®ä»•æ§˜ãªã©ã¯æ˜Žã‚‰ã‹ã«ã•ã‚Œã¦ã„ã¾ã›ã‚“ãŒã€Appleã®ç™ºè¡¨ã«ã€ŒThis might cause network and app failures and prevent websites from loading.ã€ã¨æ›¸ã‹ã‚Œã¦ã„ã‚‹ã“ã¨ã‹ã‚‰ã€å¤±åŠ¹ã—ãŸSSLè¨¼æ˜Žæ›¸ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸæ™‚ã®ã‚ˆã†ã«ã€å…¨ç”»é¢ã§ã‚¨ãƒ©ãƒ¼ãŒè¡¨ç¤ºã•ã‚Œã¦ã‚µã‚¤ãƒˆã¸ã¯ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã£ã¦ã—ã¾ã†ã“ã¨ãŒè€ƒãˆã‚‰ã‚Œã¾ã™ã€‚ è³¼å…¥æ¸ˆã¿
rin51 2020/04/11
SSL
ãƒªãƒ³ã‚¯
OpenSSLã‚’ä½¿ã£ã¦ç‹¬è‡ªCA(èªè¨¼å±€)ã‚’ç«‹ã¦ã‚‹æ–¹æ³• - ã‚‰ã£ã¡ã‚ƒã„ãƒ–ãƒã‚°
ã©ã†ã‚‚ã“ã‚“ã«ã¡ã¯ã€‚racchaiã§ã™ã€‚ ä»Šæ—¥ã¯ openssl ã§ç‹¬è‡ªCAã‚’ç«‹ã¦ã‚‹ã¨ã„ã†ã€ã‚ã¾ã‚Šéœ€è¦ã®ãªã„è©±ã‚’ã—ã¾ã™ã€‚ ç’°å¢ƒã¯ ubuntu 14.04 ã§ã™ã€‚ openssl ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« CAã‚’ä½œã‚‹ ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ä½œã‚‹ CSR ã®ä½œæˆ CSR ã«ç½²åã—ã€è¨¼æ˜Žæ›¸ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ä½œæˆã™ã‚‹ ã¾ã¨ã‚ openssl ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« ãªã«ã¯ã¨ã‚‚ã‚ã‚Œ openssl ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ãªã„ã¨å§‹ã¾ã‚Šã¾ã›ã‚“ã€‚ $ sudo apt-get install openssl ç„¡äº‹ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã§ãã¦ã„ã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¾ã™ã€‚ $ openssl version OpenSSL 1.0.1f 6 Jan 2014 CAã‚’ä½œã‚‹ åŸºæœ¬çš„ã«ã¯ openssl ã«ä»˜å±žã™ã‚‹ CA.pl ã‚’å®Ÿè¡Œã™ã‚‹ã®ã¿ã§ã€ã‚ã¨ã¯èžã‹ã‚ŒãŸã“ã¨ã«ç”ãˆã¦ã„ãã ã‘ã®ç°¡å˜ãªãŠä»•äº‹ã§ã™ã€‚ $ /usr/lib/ssl/misc/CA.pl -newca C
rin51 2018/10/01
SSL

TLS

è‡ªå·±CA

è‡ªå·±èªè¨¼å±€
ãƒªãƒ³ã‚¯
How do I create my own Certificate Authority (CA) workaround.org
rin51 2018/10/01
SSL

TLS

è‡ªå·±CA

è‡ªå·±èªè¨¼å±€
ãƒªãƒ³ã‚¯
Cipher Suites in TLS/SSL (Schannel SSP) | Microsoft Docs
A cipher suite is a set of cryptographic algorithms. The schannel SSP implementation of the TLS/SSL protocols use algorithms from a cipher suite to create keys and encrypt information. A cipher suite specifies one algorithm for each of the following tasks: Key exchange Bulk encryption Message authentication Key exchange algorithms protect information required to create shared keys. These algorithm
rin51 2018/09/12
Windowsã§ã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹SSL/TLSæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆä¸€è¦§

SSL

TLS

æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆ
ãƒªãƒ³ã‚¯
JVNVU#93502675: OpenSSL ã«è¤‡æ•°ã®è„†å¼±æ€§
2018å¹´3æœˆ27æ—¥ã€OpenSSL Project ã‚ˆã‚Š OpenSSL Security Advisory [27 Mar 2018] ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã«ã‚ˆã‚‹ã¨ã€æ¬¡ã«æŒ™ã’ã‚‹è„†å¼±æ€§ãŒä¿®æ£ã•ã‚Œã€ä¿®æ£ç‰ˆã® OpenSSL 1.0.2oã€1.1.0h ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã¾ã™ã€‚ ãªãŠã€CVE-2017-3738 ã«ã¤ã„ã¦ã¯ä»¥å‰ã® OpenSSL security advisory ã§æƒ…å ±å…¬é–‹ã•ã‚Œã€OpenSSL 1.0.2 å‘ã‘ã®ä¿®æ£ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã¾ã—ãŸãŒã€ä»Šå›ž OpenSSL 1.1.0 å‘ã‘ã®ä¿®æ£ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚‚ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚ æ·±åˆ»åº¦ - ä¸ (Severity: Moderate) Incorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733) Constructed ASN.1 types with a r
rin51 2018/09/06
security

OpenSSL

SSL

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
Security/Server Side TLS - MozillaWiki
The ordering of cipher suites in the Old configuration is very important, as it determines the priority with which algorithms are selected. OpenSSL will ignore cipher suites it doesn't understand, so always use the full set of cipher suites below, in their recommended order. The use of the Old configuration with modern versions of OpenSSL may require custom builds with support for deprecated ciphe
rin51 2018/08/29
cipher suiteä¸€è¦§ã€‚å®Ÿè£…ã«ã‚ˆã£ã¦åå‰ãŒã¾ã¡ã¾ã¡ã ã£ãŸ

TLS

SSL
ãƒªãƒ³ã‚¯
SSL/TLSãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³
â—†ã€€SSL/TLSã‚»ãƒƒã‚·ãƒ§ãƒ³ã®ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ SSLã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¨SSLã‚µãƒ¼ãƒã¨ã§ã‚„ã‚Šã¨ã‚Šã•ã‚Œã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®ãªã‹ã§ã€ä»¥ä¸‹ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«ã¤ã„ã¦ã¯ ã‚„ã‚Šã¨ã‚Šã‚’çœç•¥ã—ãŸé€šä¿¡ãŒè¡Œã‚ã‚Œã‚‹å ´åˆã‚‚ã‚ã‚Šã¾ã™ã€‚ ãƒ»ã€€Server Certificate ãƒ»ã€€Server Key Exchange ãƒ»ã€€Certificate Request ãƒ»ã€€Client Certificate ãƒ»ã€€Certificate Verify ä¾‹ãˆã°ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã‚’ä½¿ç”¨ã—ãªã„SSLé€šä¿¡ã§ã‚ã‚Œã°ã€ŒClient Certificateã¨Certificate Verifyã€ãŒçœç•¥ã€‚ â—†ã€€SSL/TLSã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ ãƒ»ã€€Client Hello SSLã®é€šä¿¡é–‹å§‹ã‚’ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‹ã‚‰ã‚µãƒ¼ãƒã«é€šçŸ¥ã™ã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã€‚ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã«å«ã¾ã‚Œã¦ã„ã‚‹å†…å®¹ã¯ä»¥ä¸‹ã§ã™ã€‚ â‡’ã€€SSL/TLSã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ä¹±æ•°ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒåˆ©ç”¨ã§ãã‚‹æš—å·
rin51 2018/08/28
ã‚·ãƒ¼ã‚±ãƒ³ã‚¹å›³

SSL

TLS
ãƒªãƒ³ã‚¯
SSL/TLSï¼ˆSSL3.0ï½žTLS1.2ï¼‰ã®ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã‚’å¾©ç¿’ã™ã‚‹
ä»¥ä¸‹é †ã‚’è¿½ã£ã¦èª¬æ˜Žã—ã¾ã™ã€‚ HelloRequest ç›¸æ‰‹ã«ClientHelloã‚’é€ä¿¡ã™ã‚‹ã‚ˆã†ä¿ƒã™ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã§ã™ã€‚é€ä¿¡ã—ãªãã¦ã‚‚æ§‹ã„ã¾ã›ã‚“ã€‚ ClientHello ServerHello ClientHelloã¨ServerHelloã¯ã€TLSã®ã²ã¨ã¤ã‚ã®è‚ã§ã™ã€‚å¾Œã»ã©èª¬æ˜Žã—ã¾ã™ã€‚ ServerCertificate ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’é€ä¿¡ã—ã¾ã™ã€‚ä¸é–“CAè¨¼æ˜Žæ›¸ãªã©ã‚‚ã€ã“ã“ã§é€ã‚Šã¾ã™ã€‚ ServerKeyExchange éµäº¤æ›ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãã®ï¼‘ã§ã™ã€‚éµäº¤æ›ã¯TLSã®ãµãŸã¤ã‚ã®è‚ã§ã€ã“ã‚Œã‚‚å¾Œã»ã©èª¬æ˜Žã—ã¾ã™ã€‚ CertificateRequest ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã‚’é€ä¿¡ã™ã‚‹ã‚ˆã†ã«ä¿ƒã™ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã§ã™ã€‚ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ãŒå¿…è¦ãªå ´åˆã«é€ä¿¡ã—ã¾ã™ã€‚ä½•ãã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã£ã¦ï¼Ÿã¨æ€ã£ãŸæ–¹ã¯èªã¿é£›ã°ã—ã¦æ§‹ã„ã¾ã›ã‚“ã€‚ ServerHelloDone ã‚µãƒ¼ãƒã‹ã‚‰ã®é€ä¿¡çµ‚äº†ã‚’ç¤ºã™ã‚¨ãƒ³ãƒ‰ãƒžãƒ¼ã‚¯ã§ã™ã€‚ Cli
rin51 2018/08/28
TLS
ãƒªãƒ³ã‚¯
Is it safe to use HTTPS without SSL certificates for my own domains?
rin51 2018/08/27
ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ä½¿ã‚ãªã„(ãã®å ´åˆã¯åŒ¿åæš—å·åŒ–ã‚’ä½¿ã†)ã“ã¨ã¯å¯èƒ½ã ãŒä¸é–“è€…æ”»æ’ƒã‚’å—ã‘ã‚‹ãƒªã‚¹ã‚¯ãŒã‚ã‚‹ã®ã§ã€éžæŽ¨å¥¨

OpenSSL

SSL
ãƒªãƒ³ã‚¯
using SSL without certificate
rin51 2018/08/27
ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ä½¿ã‚ãªã„(ãã®å ´åˆã¯åŒ¿åæš—å·åŒ–ã‚’ä½¿ã†)ã“ã¨ã¯å¯èƒ½ã ãŒä¸é–“è€…æ”»æ’ƒã‚’å—ã‘ã‚‹ãƒªã‚¹ã‚¯ãŒã‚ã‚‹ã®ã§ã€éžæŽ¨å¥¨

OpenSSL

SSL
ãƒªãƒ³ã‚¯
In which cases can an SSL server omit sending the certificate?
rin51 2018/08/27
ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ä½¿ã‚ãªã„(ãã®å ´åˆã¯åŒ¿åæš—å·åŒ–ã‚’ä½¿ã†)ã“ã¨ã¯å¯èƒ½ã ãŒä¸é–“è€…æ”»æ’ƒã‚’å—ã‘ã‚‹ãƒªã‚¹ã‚¯ãŒã‚ã‚‹ã®ã§ã€éžæŽ¨å¥¨

OpenSSL

SSL
ãƒªãƒ³ã‚¯
SMTPS - Wikipedia
SMTPS (Simple Mail Transfer Protocol Secure) is a method for securing the SMTP using transport layer security. It is intended to provide authentication of the communication partners, as well as data integrity and confidentiality. SMTPS is neither a proprietary protocol nor an extension of SMTP. It is a way to secure SMTP at the transport layer, by wrapping SMTP inside Transport Layer Security (TLS
rin51 2018/07/19
smtps

tls

ssl
ãƒªãƒ³ã‚¯
OpenSSLã‚’SSL/TLSã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¨ã—ã¦ä½¿ã£ã¦ã¿ã‚‹
$ openssl s_client -connect servername:443 ã§ SSL æŽ¥ç¶š HTTP ã®æŽ¥ç¶šã‚’ç¢ºèªã—ãŸãã¦ telnet ã‚’ä½¿ã†ã“ã¨ãŒã‚ã‚‹ã€‚ ãŸã¨ãˆã°ã€ telnet ã§ http://www.google.com:80/ ã« GET ã™ã‚‹ã«ã¯ä»¥ä¸‹ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã€‚ $ telnet www.google.com 80 Trying 173.194.117.145... Connected to www.google.com. Escape character is '^]'. GET / HTTP/1.1 host: www.google.com HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=UTF-8 Location: http://www.goog
rin51 2018/07/17
TLS

SSL

openssl
ãƒªãƒ³ã‚¯
#mailerstudy 02 ãƒ¡ãƒ¼ãƒ«ã¨æš—å· - SSL/TLS -
2. 2 ç§ã¯èª° â€¢ æ°å: æ»æ¾¤ éš†å² @ttkzw â€¢ æ‰€å±ž: æ ªå¼ä¼šç¤¾ãƒãƒ¼ãƒˆãƒ“ãƒ¼ãƒ„ â€¢ ä½•ã‚„ã£ã¦ã„ã‚‹äºº â–« ãƒ¡ãƒ¼ãƒ©Muttã®å›½éš›åŒ–ã‚„æ—¥æœ¬èªžå¯¾å¿œãƒ‘ãƒƒãƒä½œè€… â–« SpamAssassinã®æ—¥æœ¬èªžå¯¾å¿œãƒ‘ãƒƒãƒä½œè€… â€¢ ãƒ¡ãƒ¼ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã¨ã®é–¢ã‚ã‚Š â–« ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†è€…ã¨ã—ã¦1997å¹´ã‹ã‚‰2006å¹´ã¾ã§ãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ ãƒã®ç®¡ç† â–« æ˜”ã€qmailé–¢é€£ã§è‰²ã€…ã‚„ã£ã¦ã„ãŸã€‚2006å¹´ã«qmailæ¨ã¦æ¨ ã¦ã€‚Postfix/Dovecoté£ã„ã«ã‚¯ãƒ©ã‚¹ãƒã‚§ãƒ³ã‚¸ â–« ç¾åœ¨ã¯å€‹äººã‚µãƒ¼ãƒã§ãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ãƒã‚’é‹ç”¨ ï‚– Postfix + Dovecot + Sieve(dovecot-pigeonhole) + ClamAV + SpamAssassin + spamass-milter + Roundcube
rin51 2018/07/10
SSL

TLS

SMTP

SMTPS

STARTTLS
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸