[B! ssl] cubicdaiyaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

cubicdaiya id:cubicdaiya

sslã«é–¢ã™ã‚‹cubicdaiyaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (18)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OpenResty ã§è¨¼æ˜Žæ›¸ã®å‹•çš„èªã¿è¾¼ã¿ - Qiita
ssl_certificate_by_lua* ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã‚’ä½¿ç”¨ã™ã‚‹ã“ã¨ã§ã€è¨¼æ˜Žæ›¸ã‚’å‹•çš„ã«èªã¿è¾¼ã¾ã›ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ã€‚ ä¾‹ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‹ã‚‰é€ã‚‰ã‚Œã¦ããŸ ClientHello ã® SNI æ‹¡å¼µã«å«ã¾ã‚Œã¦ã„ã‚‹ã‚µãƒ¼ãƒåã«å¯¾å¿œã™ã‚‹è¨¼æ˜Žæ›¸ã‚’èªã¿è¾¼ã‚“ã§ã„ã¾ã™ã€‚ å¯¾å¿œã™ã‚‹è¨¼æ˜Žæ›¸ãŒè¦‹ã¤ã‹ã‚‰ãªã„å ´åˆã¯ ServerHello ã‚’è¿”ã•ãšã«ã€Internal Error (80) ã®ã‚¢ãƒ©ãƒ¼ãƒˆãŒè¿”ã‚Šã¾ã™ã€‚ http { lua_shared_dict certs 10m; server { listen 10443 ssl; ssl_protocols TLSv1.2; ssl_certificate certs/www.example.com.pem; ssl_certificate_key certs/www.example.com.key; ssl_session_tickets on; ssl_s
cubicdaiya 2016/12/04
ssl_certificate_by_luaã

nginx

lua

ssl
ãƒªãƒ³ã‚¯
Achieving a Perfect SSL Labs Score with Go
cubicdaiya 2016/05/23
golang

ssl
ãƒªãƒ³ã‚¯
apache 2.4ã«ãŠã‘ã‚‹SSLè¨¼æ˜Žæ›¸ã®è¨å®š - Qiita
apache 2.4ï¼ˆåŽ³å¯†ã«ã¯2.4.8ä»¥é™ï¼‰ã§SSLè¨¼æ˜Žæ›¸ã®è¨å®šã§ã¡ã‚‡ã£ã¨ãƒãƒžã£ãŸã®ã§ãƒ¡ãƒ¢ã€‚ â€»CentOS 7ç³»ã®æ¨™æº–apacheã ã¨2.4.6ã®ãŸã‚ã€ã“ã“ã§è¨˜è¼‰ã™ã‚‹apache 2.2ã®æ–¹ã®è¨å®šã«ãªã‚Šã¾ã™ã€‚æ³¨æ„ã€‚ çµè«– åˆã£ç«¯ã‹ã‚‰çµè«–ã€‚ apache 2.4ã§ã¯ä¸é–“CAè¨¼æ˜Žæ›¸ã‚’æŒ‡å®šã™ã‚‹ SSLCertificateChainFile ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ãŒãªããªã£ã¦ã¾ã™ã€‚ ãã®ãŸã‚apache 2.4ã§ã¯ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã¨ä¸é–“CAè¨¼æ˜Žæ›¸ã€ãã‚Œã‹ã‚‰ã‚¯ãƒã‚¹ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã‚’ä¸€ã¤ã®ãƒ•ã‚¡ã‚¤ãƒ«ã«ã¾ã¨ã‚ã¦ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’æŒ‡å®šã™ã‚‹ SSLCertificateFile ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã§æŒ‡å®šã—ã¾ã™ã€‚ å‚è€ƒï¼šhttp://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatechainfile apache 2.2ã§ã®è¨¼æ˜Žæ›¸æ§‹æˆ SSLCertifi
cubicdaiya 2015/07/20
apache

ssl
ãƒªãƒ³ã‚¯
ç´°ã‹ã™ãŽã¦ä¼ã‚ã‚‰ãªã„SSL/TLS
ãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã¯ã€2023å¹´10æœˆ1æ—¥ã«LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã«ãªã‚Šã¾ã—ãŸã€‚LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã®æ–°ã—ã„ãƒ–ãƒã‚°ã¯ã“ã¡ã‚‰ã§ã™ã€‚LINEãƒ¤ãƒ•ãƒ¼ Tech Blog ã€Œç´°ã‹ã„ã¨è¨€ã†ã‚ˆã‚Šé•·ã„ã‚ˆãã€ ã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€‚ATS ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸå°æŸ´ã•ã‚“ã‚„ ATS ã« HTTP/2 ã®å®Ÿè£…ã‚’è¡Œã£ã¦ã„ã‚‹å¤§ä¹…ä¿ã•ã‚“ã¨åŒã˜ãƒãƒ¼ãƒ ã®ä¸€å¹´ç›®ã€åŒ¿åç¤¾å“¡M ã•ã‚“ã‹ã‚‰ã„ã˜ã‚‰ã‚Œã¦ã„ã‚‹æ–°äººã§ã™ã€‚ä»Šå›žã‚ã‚ŠãŒãŸã„äº‹ã«ã€ã“ã†ã„ã£ãŸã™ã”ã„æ–¹ã€…ã‚’å«ã‚ãƒ¢ãƒ’ã‚«ãƒ³è«¸å…ˆè¼©æ–¹ã‚ˆã‚Šã€Œä½•ã‹æ›¸ã‹ãªã„ã®ï¼Ÿã€ã€Œã„ã¤æ›¸ãã®ï¼Ÿã€ã¨ã„ã†æ•°ã€…ã®ãƒ—ãƒ¬ãƒƒã‚·ãƒ£ãƒ¼ãŠè¨€è‘‰ã‚’ã„ãŸã ãã¾ã—ãŸã€‚ ã¨ã„ã†ã‚ã‘ã§ã€SSL/TLS ã® Session å†é–‹æ©Ÿèƒ½ã«é–¢ã—ã¦æ›¸ã„ã¦ã„ã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ SSL/TLS ã¯æ©Ÿå¯†æ€§ã€å®Œå…¨æ€§ãã—ã¦çœŸæ£æ€§ã«å¯¾ã—ã¦å®‰å…¨ãªé€šä¿¡ã‚’è¡Œã†ãŸã‚ã®ä»•çµ„ã¿ã§ã™ã€‚ã—ã‹ã—ã€ã“ã®ä»•çµ„ã¿ã¯æš—å·æŠ€è¡“ã‚’å¤šç”¨ã—ç‰¹ã«æŽ¥ç¶šã«ãŠã„ã¦è¤‡é›‘ãªãƒ—ãƒãƒˆã‚³ãƒ«ã‚’ç”¨ã„ã€Client, Se
cubicdaiya 2015/01/20
ssl
ãƒªãƒ³ã‚¯
Redirecting to ssl-config.mozilla.org...
Mozilla SSL Configuration Generator Redirecting to the updated SSL Configuration Generatorâ€¦
cubicdaiya 2015/01/07
security

https

ssl
ãƒªãƒ³ã‚¯
è¤‡æ•°ã®Webã‚µãƒ¼ãƒã§SSLã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚’å…±æœ‰ã—ã¦SSLå‡¦ç†ã‚’é«˜é€ŸåŒ–(Apache + mod_ssl + mod_socache_memcache) - å…ƒRX-7ä¹—ã‚Šã®é©å½“ãªæ—¥ã€…
HTTPS(SSLåˆ©ç”¨)ã‚µã‚¤ãƒˆãŒSEOçš„ã«å„ªé‡ã•ã‚Œã‚‹ãƒˆãƒ¬ãƒ³ãƒ‰ã§ã€ä¸–é–“çš„ã«ã‚‚HTTPSæŽ¥ç¶šã§ã‚µã‚¤ãƒˆé‹ç”¨ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ãŒå¢—ãˆã¦ãã¦ã„ã¾ã™ã€‚ ã“ã‚ŒãŒã€ãƒã‚¤ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚µã‚¤ãƒˆã«ãªã£ã¦ãã‚‹ã¨ã€ã“ã®ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã§SSLå‡¦ç†ã•ã›ã‚‹ã“ã¨ãŒè² è·çš„ã«ã‚‚ãªã‹ãªã‹è¾›ã„ã®ã§ã™ã€‚ ã§ã€Apache 2.3ä»¥é™ã§ã¯ã€Shared Object Cache Providerã¨ã—ã¦ã€memcachedãŒé¸æŠžã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ ã“ã®ä»•çµ„ã¿ã‚’åˆ©ç”¨ã—ã¦ã€Apacheã¨memcachedã‚’ä¸¦ã¹ã‚‹ã“ã¨ã§ã€å„ã‚µãƒ¼ãƒã§ãƒ¦ãƒ¼ã‚¶ã®SSL Session Cacheã‚’å…±æœ‰ã—ãªãŒã‚‰HTTPSãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’è² è·åˆ†æ•£ã§ãã‚‹æ§‹æˆã‚’ä½œã£ã¦ã¿ã¾ã—ãŸã€‚ Webã‚µãƒ¼ãƒã§SSLã‚ªãƒ•ãƒãƒ¼ãƒ‰ å¸¸æ™‚SSLã‚’åˆ©ç”¨ã—ãŸWebã‚µã‚¤ãƒˆã‚’é‹ç”¨ã™ã‚‹ãŸã‚ã«ã€SSLã‚¢ã‚¯ã‚»ãƒ©ãƒ¬ãƒ¼ã‚¿ã¨ã„ã£ãŸã‚¢ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹è£½å“ã ã¨ã‹ã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã ã¨Apacheã‚„Nginxã®SSLãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’ä½¿ã†
cubicdaiya 2014/12/05
TLS Session Ticketsä½¿ã‚ãªã„ã®ã¯ä½•æ•…ã ã‚ã†ã¨æ€ã£ãŸãŒã€(ç‰¹ã«ã‚¹ãƒžãƒ›ã ã¨)æœ€æ–°ã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã—ã‹ã‚µãƒãƒ¼ãƒˆã—ã¦ãªã„ã‹ã‚‰ã‹ãªï¼Ÿ(è¿½è¨˜:æ›¸ã„ã¦ã‚ã£ãŸ -> (SSL Session Ticketã¯æ¯”è¼ƒçš„æ–°ã—ã„ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã§ã—ã‹...))

ssl

apache
ãƒªãƒ³ã‚¯
SSL ã®è§£èª¬
SSL(Secure Socket Layer) ã¯ Netscape Communications ç¤¾ãŒææ¡ˆã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã‚ã‚Šã€æš—å·åŒ–ã€ èªè¨¼ã€ å®Œå…¨æ€§ï¼ˆæ”¹ç«„é˜²æ¢ï¼‰ã‚’æä¾›ã™ã‚‹ã€‚ OSI å‚ç…§ãƒ¢ãƒ‡ãƒ«ã§ã¯ç¬¬5å±¤ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³å±¤ã«ä½ç½®ã—ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å±¤ã‹ã‚‰é€éŽçš„ã§ã‚ã‚‹ãŸã‚ HTTP, FTP, TELNET ãªã©ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å±¤ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã®ä¸‹ã§å¯¾å¿œã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã‚ã‚‹ã€‚ åŒæ§˜ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã¨ã—ã¦ EIT (Enterprise Integration Techno logy) ã®è¨è¨ˆã«ã‚ˆã‚‹ S-HTTP (Secure HTTP) ãŒã‚ã‚‹ãŒã€HTTP ã«ç‰¹åŒ–ã—ãŸã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å±¤ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã‚ã£ãŸãŸã‚æ±Žç”¨æ€§ã«æ¬ ã‘ã¦ã„ã‚‹ã€‚ ã¾ãŸ2å¤§ãƒ–ãƒ©ã‚¦ã‚¶ã§ã‚ã‚‹ NetscapeCommunicator ã¨ InternetExplorer ãŒ SSL ã«å¯¾å¿œã—ãŸã“ã¨ã‚‚ã‚
cubicdaiya 2014/10/31
ssl
ãƒªãƒ³ã‚¯
è‡ªå •è½ãªæŠ€è¡“è€…ã®æ—¥è¨˜ : Twitterã®Perfect Forward Secrecy(PFS)å¯¾å¿œ - livedoor Blogï¼ˆãƒ–ãƒã‚°ï¼‰
åŸºæœ¬ã¯å–°ã£ã¦ã‚‹ã‹é£²ã‚“ã§ã‚‹ã‹ã§ã™ãŒã€ã‚ˆãè¶£å‘³ã§ã‚«ãƒ©ã‚ªã‚±ãƒ»PKIãƒ»ç½²åãƒ»èªè¨¼ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ã‚„ã£ã¦ã„ã¾ã™ã€‚æ—…å¥½ãã€‚ãƒ†ãƒ¬ãƒ“å¥½ãã§èŠ¸èƒ½é€š SSL/TLS CipherSuiteã‚¦ã‚©ãƒƒãƒãƒ£ãƒ¼ã®@kjurã§ã™ã€‚ TechCrunch JPã«æ˜¨æ—¥ã“ã‚“ãªè¨˜äº‹ãŒæŽ²è¼‰ã•ã‚Œã¾ã—ãŸã€‚ TwitterãŒå°†æ¥ã®æš—å·è§£èªã‚’é˜²ããŸã‚å…¨ã‚µã‚¤ãƒˆã«ã‚ãŸã£ã¦Perfect Forward Secrecyã‚’æŽ¡ç”¨ (2013å¹´11æœˆ23æ—¥) http://jp.techcrunch.com/2013/11/23/20131122twitter-enables-perfect-forward-secrecy-across-sites-to-protect-user-data-against-future-decryption/ æœ€è¿‘ã€SSL/TLS ã®CipherSuiteã«ã¤ã„ã¦ã€ã„ã‚ã„ã‚è¶£å‘³ã§èª¿ã¹ã¦ã„ã‚‹ã‚“ã§ã™ãŒ
cubicdaiya 2014/10/31
ssl

twitter

security

pfs
ãƒªãƒ³ã‚¯
SSL ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã®è£å´ è¨¼æ˜Žæ›¸å¤±åŠ¹ç¢ºèªãƒ¡ã‚«ãƒ‹ã‚ºãƒ SSL ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ãŒæƒ…å ±æ¼ãˆã„ã«å¼·ã„ç†ç”± - Symantec
cubicdaiya 2014/10/29
ssl
ãƒªãƒ³ã‚¯
ImperialViolet - Overclocking SSL
(This is a write up of the talk that I gave at Velocity 2010 last Thursday. This is a joint work of myself, Nagendra Modadugu and Wan-Teh Chang.) The â€˜Sâ€™ in HTTPS stands for â€˜secureâ€™ and the security is provided by SSL/TLS. SSL/TLS is a standard network protocol which is implemented in every browser and web server to provide confidentiality and integrity for HTTPS traffic. If there's one point tha
cubicdaiya 2014/10/29
ssl
ãƒªãƒ³ã‚¯
Nginxã§ã®OCSP Staplingå¯¾å¿œè¨å®š
æ„å¤–ã«ãƒãƒžã£ãŸã®ã§ãƒ¡ãƒ¢ã€‚ OCSPã¨ã¯ OCSPï¼ˆOnline Certificate Status Protocolï¼‰ã¨ã¯ã€SSL/TLSæš—å·åŒ–é€šä¿¡ã®åˆæœŸãƒ•ã‚§ãƒ¼ã‚ºã«ãŠã„ã¦è¨¼æ˜Žæ›¸ã®å¤±åŠ¹ã‚’ç¢ºèªã™ã‚‹ãŸã‚ã®æ‰‹é †ã€‚ å¾“æ¥ã¯ç½²åæ‰€å¤±åŠ¹ãƒªã‚¹ãƒˆ(CRL)ãŒåˆ©ç”¨ã•ã‚Œã¦ã„ãŸãŒã€CRLã¯ãƒªã‚¹ãƒˆãŒè‚¥å¤§åŒ–ã—ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã«éžå¸¸ã«æ™‚é–“ãŒã‹ã‹ã‚‹ã‚ˆã†ã«ãªã£ã¦ããŸãŸã‚ã€å˜ä¸€ãƒ¬ã‚³ãƒ¼ãƒ‰ã®å–å¾—ã§æ¸ˆã‚€OCSPãŒã€ç¾åœ¨ã§ã¯è¨¼æ˜Žæ›¸ã®å¤±åŠ¹ã‚’ç¢ºèªã™ã‚‹æ–¹æ³•ã¨ã—ã¦ä¸€èˆ¬çš„ã«ãªã£ãŸã€‚ OCSP Staplingã¨ã¯ é€šå¸¸ã¯ä»¥ä¸‹ã®å›³ã®ã‚ˆã†ã«ã€è¨¼æ˜Žæ›¸ã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ãŸã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒOCSP Responderã«ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã®å¤±åŠ¹ã‚’ç¢ºèªã™ã‚‹ã€‚ OCSP Staplingã«å¯¾å¿œã™ã‚‹ã¨ã€ä»¥ä¸‹ã®å›³ã®ã‚ˆã†ã«è¨¼æ˜Žæ›¸ã®å¤±åŠ¹ç¢ºèªã‚’ã‚µãƒ¼ãƒå´ã§å‡¦ç†ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ ã¾ãŸã€OCSPãƒ¬ã‚¹ãƒãƒ³ã‚¹ã¯ä¸€å®šã®é–“ã¯ã‚µãƒ¼ãƒã«ã‚ãƒ£ãƒƒã‚·ãƒ¥ã•ã‚Œã€éƒ½åº¦OCSP Responderã«å•ã„åˆã‚ã›
cubicdaiya 2014/10/29
nginx

ssl
ãƒªãƒ³ã‚¯
Document Search
cubicdaiya 2014/10/28
ssl
ãƒªãƒ³ã‚¯
Announcing Keyless SSLâ„¢: All the Benefits of CloudFlare Without Having to Turn Over Your Private SSL Keys
Announcing Keyless SSLâ„¢: All the Benefits of CloudFlare Without Having to Turn Over Your Private SSL Keys2014-09-18 CloudFlare is an engineering-driven company. This is a story we're proud of because it embodies the essence of who we are: when faced with a probl em, we found a novel solution. Technical details to follow but, until then, welcome to the no hardware world. (Update: The post with the t
cubicdaiya 2014/10/05
ssl

cloudflare
ãƒªãƒ³ã‚¯
SSL/TLSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®æ£ã—ã„ä½¿ã„æ–¹ï¼ˆã‚‚ã—ãã¯ã€ã‚³ãƒ¢ãƒ³ãƒãƒ¼ãƒ ã®æ¤œè¨¼ã«ã¤ã„ã¦ï¼‰
ã‚¹ãƒžãƒ›ã‚¢ãƒ—ãƒªã®å¸‚å ´æ‹¡å¤§ã«ä¼´ã„ã€ç›´æŽ¥SSL/TLSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’ä½¿ç”¨ã™ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’æ›¸ãæ©Ÿä¼šã‚‚å¢—ãˆã¦ãã¦ã„ã‚‹ä»Šæ—¥ã“ã®é ƒã‹ã¨æ€ã„ã¾ã™ã€‚ SSL/TLSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’ä½¿ã†éš›ã«ã¯ã€æŽ¥ç¶šç¢ºç«‹æ™‚ã«ã‚µãƒ¼ãƒã®èªè¨¼ã‚’æ£ã—ãè¡Œã†å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚å…·ä½“çš„ã«ã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ—ãƒã‚°ãƒ©ãƒ ã§ä»¥ä¸‹ã®ï¼’ç¨®é¡žã®æ¤œè¨¼ã‚’è¡Œã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ SSL/TLSãƒ©ã‚¤ãƒ–ãƒ©ãƒªãŒã‚µãƒ¼ãƒã®è¨¼æ˜Žæ›¸ã®æ¤œè¨¼ã«æˆåŠŸã—ãŸã“ã¨ ã‚µãƒ¼ãƒã®è¨¼æ˜Žæ›¸ã«å«ã¾ã‚Œã‚‹ã‚³ãƒ¢ãƒ³ãƒãƒ¼ãƒ æ³¨1ãŒæŽ¥ç¶šã—ã‚ˆã†ã¨ã—ãŸã‚µãƒ¼ãƒã¨åŒä¸€ã§ã‚ã‚‹ã“ã¨ å‰è€…ã«ã¤ã„ã¦ã¯ã€OpenSSLã®å ´åˆã¯SSL_CTX_set_verifyã®å¼•æ•°ã«SSL_VERIFY_PEERã‚’æŒ‡å®šã™ã‚‹ãªã©ã—ã¦ã€ãƒ©ã‚¤ãƒ–ãƒ©ãƒªå´ã§å‡¦ç†ã‚’è¡Œã‚ã›ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ï¼ˆè¨¼æ˜Žæ›¸ã®æ¤œè¨¼ã«å¤±æ•—ã—ãŸå ´åˆã¯SSL_connectãŒã‚¨ãƒ©ãƒ¼ã‚’è¿”ã—ã¾ã™ï¼‰ã€‚ ä¸€æ–¹ã€å¾Œè€…ã«ã¤ã„ã¦ã¯SSL/TLSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã«ã‚ˆã£ã¦å·®ãŒã‚ã‚Šã€æ¤œè¨¼æ©Ÿèƒ½ã‚’æœ‰åŠ¹ã«ã™ã‚‹ãŸã‚ã«ç‰¹åˆ¥ãªå‘¼å‡ºãŒå¿…è¦ã ã£
cubicdaiya 2014/01/28
ssl
ãƒªãƒ³ã‚¯
Optimizing NGINX TLS Time To First Byte (TTTFB) - igvita.com
By Ilya Grigorik on December 16, 2013 Network latency is one of our primary performance bottlenecks on the web. In the worst case, new navigation requires a DNS lookup, TCP handshake, two roundtrips to negotiate the TLS tunnel, and finally a minimum of another roundtrip for the actual HTTP request and response â€” that's five network roundtrips to get the first few bytes of the HTML document! Modern
cubicdaiya 2013/12/17
nginx

ssl
ãƒªãƒ³ã‚¯
ãƒ¢ãƒã‚¤ãƒ«ã‚¦ã‚§ãƒ–ç’°å¢ƒã®HTTPSã®ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚° Â« NAVER Engineers' Blog
ã“ã‚“ã«ã¡ã¯æ¤œç´¢ã‚µãƒ¼ãƒ“ã‚¹é–‹ç™ºï¼”ãƒãƒ¼ãƒ ã®å´”ç‰ç§€ã¨ç”³ã—ã¾ã™ã€‚ ã‚¤ãƒ³ãƒ•ãƒ©ã‚„ã‚·ã‚¹ãƒ†ãƒ ã¨ã®é€£æºã‚„çµ±è¨ˆã®ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã‚’æ‹…å½“ã—ã¦ãŠã‚Šã¾ã™ã€‚ ãƒ¢ãƒã‚¤ãƒ«ã®ã‚¦ã‚§ãƒ–ç’°å¢ƒã¯PCã®ã‚¦ã‚§ãƒ–ä½¿ç”¨ç’°å¢ƒã¨ã¯è‰²ã€…ãªé•ã„ãŒæœ‰ã‚Šã¾ã™ã€‚ ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã®é€Ÿåº¦ã ã‘ã§ã¯ãªããƒãƒƒãƒ†ãƒªãƒ¼ã®åŠ¹çŽ‡ã‚’è€ƒãˆãŸä»•çµ„ã¿ãªã©ã€PCã«æ¯”ã¹ãƒªã‚½ãƒ¼ã‚¹ãŒååˆ†ã§ã¯ãªã„ãŸã‚ãƒ¢ãƒã‚¤ãƒ«ãƒ–ãƒ©ã‚¦ã‚¶ã®å‹•ä½œãŒç•°ãªã£ã¦ã„ã‚‹ã“ã¨ã‚‚æœ‰ã‚Šã¾ã™ã€‚ ä»Šå›žã¯ãƒ¢ãƒã‚¤ãƒ«ã®ã‚¦ã‚§ãƒ–Applicationã«ãŠã‘ã‚‹SSLé–¢ä¿‚ã®æ€§èƒ½ã«é–¢ã™ã‚‹å·¥å¤«ã®å†…å®¹ã‚’Q&Aå½¢å¼ã§è§£èª¬ã—ã¦ã„ãã¾ã™ã€‚ Q. ä½•ãŒå•é¡Œã§ã—ãŸã‹ï¼Ÿ A. ãƒ¢ãƒã‚¤ãƒ«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆ(iPhone, Android)ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‹ã‚‰ã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã®å¿œç”æ™‚é–“ã«é…å»¶ã®å•é¡ŒãŒæœ‰ã‚Šã¾ã™ã€‚ æœ€åˆã¯web access logã‹ã‚‰ã®slow response(ï¼‘ç§’ä»¥ä¸Š)ã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆãŒçµæ§‹ã‚ã‚Šã¾ã—ãŸã€‚ ãã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’protoc
cubicdaiya 2013/09/09
http

ssl
ãƒªãƒ³ã‚¯
GPUã‚’ç”¨ã„ãŸSSLãƒªãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ã®å®Ÿè£…ã«ã¤ã„ã¦ - ã‚†ã†ã†ããƒ–ãƒã‚°
è¿‘å¹´ï¼Œæ±Žç”¨è¨ˆç®—ã®é«˜é€ŸåŒ–ã®ãŸã‚ã®ã‚¢ã‚¯ã‚»ãƒ©ãƒ¬ãƒ¼ã‚¿ã¨ã—ã¦æ³¨ç›®ã•ã‚Œã¦ã„ã‚‹GPUã‚’ï¼Œãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯å‡¦ç†ã«é©ç”¨ã™ã‚‹ä¸€ç’°ã¨ã—ã¦ï¼Œã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã®SSLå‡¦ç†ã«æ³¨ç›®ã—ãŸè«–æ–‡ã‚’èªã‚“ã ã®ã§ï¼Œå†…å®¹ã‚’è»½ãç´¹ä»‹ã—ã¾ã™ï¼Ž SSLShader - GPU-accelerated SSL Proxy SSLShader SSLShader: Cheap SSL acceleration with commodity processors Proceedings of the 8th USENIX conference on Networked systems design and implementation 2011 ãªãŠï¼Œè©•ä¾¡ã«ä½¿ã‚ã‚ŒãŸå®Ÿè£…ã®ä¸€éƒ¨ã®ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ï¼Ž http://shader.kaist.edu/sslshader/libgpu crypto/ ç´¹ä»‹ èƒŒæ™¯ SSL(Secure Socket
cubicdaiya 2013/04/18
ssl

gpu
ãƒªãƒ³ã‚¯
ãªãœã‚ãªãŸãŒã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’HTTPSåŒ–ã™ã‚‹ã¨ã‚µã‚¤ãƒˆãŒé…ããªã£ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒé€ƒã’ã¦ã„ãã®ã‹ - å°„æ’ƒã—ã¤ã¤å‰è»¢ æ”¹
å®Œå…¨ã«é‡£ã‚Šã‚¿ã‚¤ãƒˆãƒ«ã§ã™ã‘ã©ä¸èº«ã¯çœŸé¢ç›®ã«æ›¸ãã‚ˆã€‚ è¿‘å¹´ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®HTTPSåŒ–ãŒæµè¡Œã®ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã€‚ç§ã®çŸ¥ã‚‹é™ã‚Šã€Googleã®å„ç¨®ã‚µãƒ¼ãƒ“ã‚¹ã‚„Twitterã€Facebookãªã©ãŒå®Œå…¨ã«HTTPSã§é€šä¿¡ã‚’è¡Œã†ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã€‚HTTPSã€ã¤ã¾ã‚ŠSSLã«ã‚ˆã‚‹é€šä¿¡ã®æš—å·åŒ–ã«ã‚ˆã£ã¦ã€ãƒ¦ãƒ¼ã‚¶ã«ã“ã‚Œã¾ã§ã‚ˆã‚Šã‚‚å®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’æä¾›ã§ãã‚‹ã€‚ ã—ã‹ã—ã€ã‚ãªãŸãŒä½œã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã‚’ãµã¨æ€ã„ã¤ãã§HTTPSåŒ–ã—ã¦ã—ã¾ã†ã¨ã€ãŸã¶ã‚“ã€ã“ã‚Œã¾ã§ã‚ˆã‚Šã‚‚ã‚µã‚¤ãƒˆãŒé…ããªã‚‹ã€‚ã“ã“ã§ã¯ã€HTTPSã§é€šä¿¡ã™ã‚‹å ´åˆã®å•é¡Œã‚’è§£èª¬ã™ã‚‹ã€‚ ãªãœé…ããªã‚‹ã®ã‹ HTTPã§é€šä¿¡ã™ã‚‹å ´åˆã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒã‚µãƒ¼ãƒã¸ã¨æŽ¥ç¶šã™ã‚‹ãŸã‚ã«ã¯TCP/IPã®3ã‚¦ã‚§ã‚¤ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã¨ã„ã†æ‰‹é †ãŒå¿…è¦ã«ãªã‚‹ã€‚ã‚ã‚“ã©ãã•ã„ã®ã§ã“ã“ã§ã¯è©³ã—ãã¯èª¬æ˜Žã—ãªã„ãŒã€è¦ã™ã‚‹ã«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’æŠ•ã’ã‚‹å‰ã«ãƒ‘ã‚±ãƒƒãƒˆã‚’ï¼‘å¾€å¾©ã•ã›ãªã„ã¨ã„ã‘ãªã„ã®ã§ã‚ã‚‹ã€‚ãƒ‘ã‚±ãƒƒãƒˆã®å¾€å¾©
cubicdaiya 2013/01/08
ssl
ãƒªãƒ³ã‚¯
1