[B! TLS] strskã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

strsk id:strsk

TLSã«é–¢ã™ã‚‹strskã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
strsk 2015/12/03
ssl

tls
ãƒªãƒ³ã‚¯
SSL/TLSã®åŸºç¤Žã¨æœ€æ–°å‹•å‘
1. SSL/TLSã®åŸºç¤Žã¨æœ€æ–°å‹•å‘ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚ãƒ£ãƒ³ãƒ— 2015 2015å¹´8æœˆ12æ—¥ IIJ å¤§æ´¥ ç¹æ¨¹ æ›´æ–°ç‰ˆè³‡æ–™ã®ç½®å ´ http://goo.gl/cX1M17 Github Repo: https://goo.gl/vRLzrj 2. è‡ªå·±ç´¹ä»‹ â€¢ å¤§æ´¥ ç¹æ¨¹ â€¢ æ ªå¼ä¼šç¤¾ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¤ãƒ‹ã‚·ã‚¢ãƒ†ã‚£ãƒ– â€¢ ãƒ—ãƒãƒ€ã‚¯ãƒˆæœ¬éƒ¨ ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºéƒ¨ã‚µãƒ¼ãƒ“ã‚¹é–‹ç™º2èª² â€¢ NodeJS Technical Committee ãƒ¡ãƒ³ãƒãƒ¼ â€¢ (ä¸»ã«TLS/CRYPTO/OpenSSLãƒã‚¤ãƒ³ãƒ‡ã‚£ãƒ³ã‚°ã‚’æ‹…å½“ï¼‰ â€¢ IETF httpbis WG ã§ HTTP/2ç›¸äº’æŽ¥ç¶šè©¦é¨“ç‰ä»•æ§˜ç–å®šã«å‚ç”»ã€‚ â€¢ ãƒ–ãƒã‚°ï¼š http://d.hatena.ne.jp/jovi0608/ 3. ã¯ã˜ã‚ã« â€¢ TLS(Transport Layer Security)ã®ä»•çµ„ã¿ã«ã¤ã„ã¦å¦ã‚“ã§ã„ãŸã ã ã¾ã™ã€‚ â€¢
strsk 2015/08/14
TLS

SSL

http

https

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Revoking Intermediate Certificates: Introducing OneCRL | Mozilla Security Blog
Users of Firefox from Firefox 37 will be protected by a new feature called OneCRL. This is a new mechanism we have introduced to push lists of revoked intermediate certificates to the browser. Using OCSP for certificate revocation doesnâ€™t serve users very well. For online revocation checks, either you have a system that fails open or you accept the performance penalty of checks that are more stric
strsk 2015/03/17
ocsp

ssl

tls
ãƒªãƒ³ã‚¯
Node-v0.12ã®TLSã‚’256å€ä½¿ã„ã“ãªã™æ–¹æ³•
2. è‡ªå·±ç´¹ä»‹ â€¢ åå‰ï¼š å¤§æ´¥ ç¹æ¨¹ â€¢ æ‰€å±žï¼š æ ªå¼ä¼šç¤¾ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¤ãƒ‹ã‚·ã‚¢ãƒ†ã‚£ãƒ–(IIJ) ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºéƒ¨ â€¢ Twitter: @jovi0608 â€¢ ãƒ–ãƒã‚°ï¼š ã¼ã¡ã¼ã¡æ—¥è¨˜ http://d.hatena.ne.jp/jovi0608/ â€¢ GitHub: https://github.com/shigeki/ â€¢ æ–°æŠ€è¡“ã®æ¤œè¨¼ãƒ»è©•ä¾¡ã‚’è¡Œã£ã¦ã¾ã™ã€‚ (Node.js, SPDY, HTTP/2,HTML5) â€¢ iij-http2ã®é–‹ç™ºã‚’é€šã˜ã¦IETFã®HTTP/2æ¨™æº–åŒ–ä½œæ¥ã«å‚ç”»ä¸ â€¢ Node-v0.11.x ã¸ã®ãƒ‘ãƒƒãƒæå‡ºã¯ã‚ãšã‹ã€‚ã§ã‚‚ã»ã¨ã‚“ã©TLSé–¢é€£ã§ã™ã€‚ 3. TLS (Transport Layer Security)ã®åˆ©ç”¨çŠ¶æ³ TLSé€šä¿¡ èªè¨¼ã€æš—å·åŒ–ã€ æ”¹ã–ã‚“é˜²æ¢ å›³å‚ç…§ https://plus.google.com/+IlyaGrigorik/po
strsk 2015/03/03
TLS

js

ssl

nodejs
ãƒªãƒ³ã‚¯
ãªãœHTTPSã¯HTTPã‚ˆã‚Šé€Ÿã„ã®ã‹
å…ˆé€±ã€httpvshttps.com ã¨ã„ã†ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ã“ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã§ã¯ã€HTTP ã¨ HTTPS ã‚’ç”¨ã„ã¦ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸå ´åˆã®ã‚¦ã‚§ãƒ–ãƒšãƒ¼ã‚¸ã®ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰å®Œäº†ã¾ã§ã«ã‹ã‹ã‚‹æ™‚é–“ã®æ¯”è¼ƒãŒã§ãã‚‹ã®ã§ã™ãŒã€å¤šãã®ç’°å¢ƒã§ HTTPS ã®æ–¹ãŒ HTTP ã‚ˆã‚Šã‚‚é«˜é€Ÿãªã“ã¨ã«é©šãã®å£°ãŒä¸ŠãŒã£ã¦ã„ã¾ã—ãŸã€‚ HTTP ãŒ TCP ä¸Šã§å¹³æ–‡ã‚’é€å—ä¿¡ã™ã‚‹ã®ã«å¯¾ã—ã€HTTPS ã¯ TCP ä¸Šã§ TLS (SSL) ã¨ã„ã†æš—å·åŒ–æŠ€è¡“ã‚’ç”¨ã„ã¦é€šä¿¡ã‚’è¡Œã„ã¾ã™ã€‚ãªã‚‰ã°ã€TLS ã®ã‚ªãƒ¼ãƒãƒ¼ãƒ˜ãƒƒãƒ‰ã®ã¶ã‚“ HTTPS ã®ã»ã†ãŒé…ã„ã¯ãšã ã€ã¨ã„ã†äºˆæ¸¬ã«åã™ã‚‹çµæžœã«ãªã£ãŸã®ã§ã™ã‹ã‚‰ã€é©šãã®ã‚‚ç„¡ç†ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ å®Ÿã¯ã€ã“ã®çµæžœã«ã¯ã‹ã‚‰ãã‚ŠãŒã‚ã‚Šã¾ã—ãŸã€‚ Google Chromeã€Mozilla Firefoxã€æœ€è¿‘ã®Safariæ³¨1ã¯ã€Google ãŒé–‹ç™ºã—ãŸé€šä¿¡ãƒ—ãƒãƒˆã‚³ãƒ«ã€ŒSPDYã€ã«å¯¾å¿œã—ã¦ãŠã‚Šã€HTTPS
strsk 2014/12/08
ã¤ã¥ãï¼

https

http

TLS

spdy

http2

h20
ãƒªãƒ³ã‚¯
TLS & Perfect Forward Secrecy
Once the private key of some HTTPS web site is compromised, an attacker is able to build a man-in-the-middle attack to intercept and decrypt any communication with the web site. The first step against such an attack is the revocation of the associated certificate through a CRL or a protocol like OCSP. Unfortunately, the attacker could also have recorded past communications protected by this privat
strsk 2014/07/03
SSL

TLS
ãƒªãƒ³ã‚¯
1