[B! TLS][tls] nekoruriã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

nekoruri id:nekoruri

TLSã¨tlsã«é–¢ã™ã‚‹nekoruriã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ä¿¡é ¼ã—ã¦ã„ã‚‹CAã‚’ãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ã™ã‚‹ TLS Trust Anchor Negotiation ã®ãƒ¡ãƒ¢ - ASnoKaze blog
IETFã®TLS WGã§ã¯ã€Googleã®æ–¹ã‚‰ã«ã‚ˆã£ã¦ææ¡ˆã•ã‚Œã¦ã„ã‚‹ã€ŽTLS Trust Anchor Negotiationã€ã¨ã„ã†ä»•çµ„ã¿ãŒè°è«–ã•ã‚Œã¦ã„ã¾ã™ã€‚ ã“ã‚Œã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¨ã‚µãƒ¼ãƒå´ã§å…±ã«ä¿¡é ¼ã§ãã‚‹CA(ãƒˆãƒ©ã‚¹ãƒˆã‚¢ãƒ³ã‚«ãƒ¼)ã‚’ãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ã—ã€è¤‡æ•°ã‚ã‚‹ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‹ã‚‰é©åˆ‡ãªã‚‚ã®ã‚’æä¾›ã§ãã‚‹ã‚ˆã†ã«ã™ã‚‹ä»•çµ„ã¿ã§ã™ã€‚ (å¼•ç”¨: IETF 120 ã‚¹ãƒ©ã‚¤ãƒ‰ PDF ã‚ˆã‚Š) å…·ä½“çš„ãªææ¡ˆä»•æ§˜ã‚ˆã‚Šã‚‚ã€explainer ã‚’èªã‚€ã®ãŒåˆ†ã‹ã‚Šã‚„ã™ã„ã€‚è‡ªåˆ†ç”¨ã«è»½ãç›®ã‚’é€šã—ã¦ãŠã https://github.com/davidben/tls-trust-expressions/blob/main/explainer.md ç›®æ¬¡ èƒŒæ™¯ ç›®æ¨™ å®Ÿç¾æ¡ˆ Trust Expressions Trust Anchor Identifiers èƒŒæ™¯ ç¾çŠ¶ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒã©ã®CAã‚’ä¿¡é ¼ã—ã¦ã„ã‚‹ã‹ä¼ãˆãšã€ã‚µãƒ¼ãƒå´ã¯
nekoruri 2024/08/21
security

tls

pki
ãƒªãƒ³ã‚¯
HTTPS è¨¼æ˜Žæ›¸ã® Common Name ã®æ¤œè¨¼ãŒã—ã‚Œã£ã¨ç¦æ¢ã•ã‚Œã¦ã„ãŸä»¶ã«ã¤ã„ã¦ | IIJ Engineers Blog
é–‹ç™ºãƒ»é‹ç”¨ã®ç¾å ´ã‹ã‚‰ã€IIJã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒæŠ€è¡“çš„ãªæƒ…å ±ã‚„å–ã‚Šçµ„ã¿ã«ã¤ã„ã¦åŸ·ç†ã™ã‚‹å…¬å¼ãƒ–ãƒã‚°ã‚’é‹å–¶ã—ã¦ã„ã¾ã™ã€‚ ã“ã‚“ã«ã¡ã¯ã€‚IIJ Engineers Blogç·¨é›†éƒ¨ã§ã™ã€‚ IIJã®ç¤¾å†…æŽ²ç¤ºæ¿ã§ã¯ã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ã¡ã‚‡ã£ã¨ã—ãŸæŠ€è¡“ãƒã‚¿ãŒå¥½è©•ã¨ãªã£ã¦å¤šãã®ã‚³ãƒ¡ãƒ³ãƒˆãŒä»˜ã„ãŸã‚Šã€ãŠå½¹ç«‹ã¡æƒ…å ±ãŒæŽ²è¼‰ã•ã‚Œã¦ã„ã¾ã™ã€‚ ä»Šå›žã¯ã€ã™ã§ã«ãŠæ°—ã¥ãã®æ–¹ã‚‚ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€ã„ã¤ã®é–“ã«ã‹Â HTTPS è¨¼æ˜Žæ›¸ã® Common Name ã®æ¤œè¨¼ãŒç¦æ¢ ã«ãªã£ã¦ã„ãŸä»¶ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ HTTPS è¨¼æ˜Žæ›¸ã®æ¤œè¨¼æ‰‹ç¶šãã¯ã€RFC2818 ã§ã€ŒSubject Alternative Name ãŒã‚ã‚Œã°ãã‚Œã§ã€ãªã‘ã‚Œã° Common Name ã‚’è¦‹ã‚ˆã€ã¨ãªã£ã¦ã„ã¾ã—ãŸã€‚ If a subjectAltName extension of type dNSName is present, that MUST be used as
nekoruri 2022/09/05
ã¾ã˜ã‹

security

tls
ãƒªãƒ³ã‚¯
Certificate Transparencyï¼ˆé€ã‹ã—å…¥ã‚Šè¨¼æ˜Žæ›¸ï¼‰ã¨ã¯|ã‚·ãƒžãƒ³ãƒ†ãƒƒã‚¯
Certificate Transparencyï¼ˆä»¥ä¸‹ã€ŒCTã€ï¼‰ã¨ã¯ã€SSL/TLSã®ä¿¡é ¼æ€§ã‚’é«˜ã‚ã‚‹ãŸã‚ã®æ–°ãŸãªæŠ€è¡“ã§ã€Googleç¤¾ã«ã‚ˆã‚Šæå”±ã•ã‚Œã¾ã—ãŸã€‚ç¾åœ¨ã¯RFC6962ã¨ã—ã¦RFCåŒ–ã•ã‚Œã€è¨¼æ˜Žæ›¸ã®èª¤ç™ºè¡Œã‚’é˜²ãæ–°ãŸãªæŠ€è¡“ã¨ã—ã¦æ³¨ç›®ã•ã‚Œã¦ã„ã¾ã™ã€‚ CTã¯èªè¨¼å±€ãŒè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹éƒ½åº¦ã€å…¨ã¦ã®è¨¼æ˜Žæ›¸ç™ºè¡Œã®è¨¼è·¡ã‚’ã€ç¬¬ä¸‰è€…ã®ç›£æŸ»ãƒã‚°ã«è¨˜è¼‰ã™ã‚‹ä»•çµ„ã¿ã§ã™ã€‚ä¸»ã«ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®é‹å–¶è€…ã‚„ãƒ‰ãƒ¡ã‚¤ãƒ³åã®ç®¡ç†è€…ãŒã€ãã®ç›£æŸ»ãƒã‚°ã‚µãƒ¼ãƒï¼ˆä»¥ä¸‹ã€Œãƒã‚°ï¼‰ï¼‰ã‚’ç¢ºèªã™ã‚‹ã“ã¨ã§ã€è‡ªåˆ†ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã«å¯¾ã—ã¦ä¸æ£ãªè¨¼æ˜Žæ›¸ã‚„ã€ãƒãƒªã‚·ãƒ¼å¤–ã®èªè¨¼å±€ã‹ã‚‰ã®è¨¼æ˜Žæ›¸ãŒç™ºè¡Œã•ã‚Œã¦ã„ãªã„ã‹ã‚’æ¤œè¨¼ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ãã‚Œã«ã‚ˆã‚Šåˆ©ç”¨è€…ãŒä¸æ£ã«ç™ºè¡Œã•ã‚ŒãŸè¨¼æ˜Žæ›¸ã‚’ä¿¡é ¼ã™ã‚‹ã“ã¨ã‚’é˜²æ¢ã—ã¾ã™ã€‚ CTã¯ã‚ãã¾ã§è¨¼æ˜Žæ›¸ã®ä¿¡é ¼æ€§ã‚’é«˜ã‚ã‚‹ãŸã‚ã®è¿½åŠ ã®ä»•çµ„ã¿ã§ã‚ã‚Šã€ã“ã‚Œã¾ã§ã®è¨¼æ˜Žæ›¸ã®æ¤œè¨¼ã®ä»•çµ„ã¿ãŒç„¡ããªã‚‹ã‚ã‘ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ ãƒã‚°ã«è¨¼æ˜Žæ›¸ã‚’æä¾›ã™ã‚‹ã¨ã€ãƒã‚°ã‹ã‚‰ã¯S
nekoruri 2016/12/14
ãŠã€ãŠã†ã€‚

TLS
ãƒªãƒ³ã‚¯
SSL and TLS Deployment Best Practices
Version 1.6-draft (15 January 2020) SSL/TLS is a deceptively simple techno logy. It is easy to deploy, and it just works--except when it does not. The main probl em is that encryption is not often easy to deploy correctly. To ensure that TLS provides the necessary security, system administrators and developers must put extra effort into properly configuring their servers and developing their applica
nekoruri 2016/06/28
Security

TLS
ãƒªãƒ³ã‚¯
Tag: ssllabs | Qualys Security Blog
Join the discussion today! Learn more about Qualys and industry best practices. Share what you know and build a reputation. Secure your systems and improve security for everyone.
nekoruri 2016/06/28
security

TLS
ãƒªãƒ³ã‚¯
AWS ELBã«çµ„ã¿è¾¼ã‚“ã Letâ€™s Encryptã‚’ãƒ€ã‚¦ãƒ³ã‚¿ã‚¤ãƒ ã‚¼ãƒã§æ›´æ–°ã™ã‚‹ - Qiita
0. èƒŒæ™¯ ç„¡æ–™ã®SSLè¨¼æ˜Žæ›¸ã¨ã„ã†ã“ã¨ã§è©±é¡Œã®Let's Encryptã§ã™ãŒã€å®Ÿéš›ã®åˆ©ç”¨ã®ãŸã‚ã«ã¯ 90æ—¥ã”ã¨ ã«è¨¼æ˜Žæ›¸ã‚’æ›´æ–°ã—ãªã„ã¨ã„ã‘ãªã„ã¨ã„ã†åˆ¶ç´„ã‹ã‚‰ã€ãªã‹ãªã‹æœ¬ç•ªåˆ©ç”¨ã™ã‚‹ã«ã¯è…°ãŒé‡ããªã£ã¦ã—ã¾ã„ã¾ã™ã€‚ ï¼ˆã‚‚ã¡ã‚ã‚“æœ¬å®¶ã§ã¯ã€å…¨è‡ªå‹•ã§æ›´æ–°ã™ã‚‹ã“ã¨ã‚’æŽ¨å¥¨ã—ã¦ã„ã¾ã™ã€‚ï¼‰ ã¾ã—ã¦ã‚„ã€AWS ELBãªã©ã®ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚µãƒ¼ã‚’åˆ©ç”¨ã—ã€é…ä¸‹ã«è¤‡æ•°ã®Webã‚µãƒ¼ãƒãŒã„ã‚‹ã¨ã€ACMEãƒ—ãƒãƒˆã‚³ãƒ«ã‚’é€šéŽã•ã›ã‚‹ã ã‘ã§ä¸€è‹¦åŠ´ã§ã™ã€‚ ãã“ã§ã€nginxã®ãƒªãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ã‚’ä½¿ã†ã“ã¨ã§ã€æ—¢å˜ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å½±éŸ¿ã‚’ã‚ãŸãˆã‚‹ã“ã¨ç„¡ãã€Let's Encryptã®æ›´æ–°ã‚’æ¸ˆã¾ã›ã‚‹æ–¹æ³•ã‚’è©¦ã—ã¾ã—ãŸã€‚ 1. å‰æ ä»Šå›žã¯ã€ä»¥ä¸‹ã®æ§˜ãªç’°å¢ƒã‚’æƒ³å®šã—ã¾ã™ã€‚ www.example.com ã§å—ã‘ã‚‹ELBã®é…ä¸‹ã«è¤‡æ•°ã®Webã‚µãƒ¼ãƒãŒã‚ã‚‹ stg.example.com ã§å—ã‘ã‚‹ELBã®é…ä¸‹ã«Webã‚µãƒ¼ãƒãŒã‚ã‚‹ www.exampl
nekoruri 2016/03/24
ã„ã„ã‹ã‚“ã˜

TLS

AWS

letsencrypt
ãƒªãƒ³ã‚¯
è¤‡æ•°ã®Webã‚µãƒ¼ãƒã§SSLã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚’å…±æœ‰ã—ã¦SSLå‡¦ç†ã‚’é«˜é€ŸåŒ–(Apache + mod_ssl + mod_socache_memcache) - å…ƒRX-7ä¹—ã‚Šã®é©å½“ãªæ—¥ã€…
HTTPS(SSLåˆ©ç”¨)ã‚µã‚¤ãƒˆãŒSEOçš„ã«å„ªé‡ã•ã‚Œã‚‹ãƒˆãƒ¬ãƒ³ãƒ‰ã§ã€ä¸–é–“çš„ã«ã‚‚HTTPSæŽ¥ç¶šã§ã‚µã‚¤ãƒˆé‹ç”¨ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ãŒå¢—ãˆã¦ãã¦ã„ã¾ã™ã€‚ ã“ã‚ŒãŒã€ãƒã‚¤ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚µã‚¤ãƒˆã«ãªã£ã¦ãã‚‹ã¨ã€ã“ã®ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã§SSLå‡¦ç†ã•ã›ã‚‹ã“ã¨ãŒè² è·çš„ã«ã‚‚ãªã‹ãªã‹è¾›ã„ã®ã§ã™ã€‚ ã§ã€Apache 2.3ä»¥é™ã§ã¯ã€Shared Object Cache Providerã¨ã—ã¦ã€memcachedãŒé¸æŠžã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ ã“ã®ä»•çµ„ã¿ã‚’åˆ©ç”¨ã—ã¦ã€Apacheã¨memcachedã‚’ä¸¦ã¹ã‚‹ã“ã¨ã§ã€å„ã‚µãƒ¼ãƒã§ãƒ¦ãƒ¼ã‚¶ã®SSL Session Cacheã‚’å…±æœ‰ã—ãªãŒã‚‰HTTPSãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’è² è·åˆ†æ•£ã§ãã‚‹æ§‹æˆã‚’ä½œã£ã¦ã¿ã¾ã—ãŸã€‚ Webã‚µãƒ¼ãƒã§SSLã‚ªãƒ•ãƒãƒ¼ãƒ‰ å¸¸æ™‚SSLã‚’åˆ©ç”¨ã—ãŸWebã‚µã‚¤ãƒˆã‚’é‹ç”¨ã™ã‚‹ãŸã‚ã«ã€SSLã‚¢ã‚¯ã‚»ãƒ©ãƒ¬ãƒ¼ã‚¿ã¨ã„ã£ãŸã‚¢ãƒ—ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹è£½å“ã ã¨ã‹ã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã ã¨Apacheã‚„Nginxã®SSLãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’ä½¿ã†
nekoruri 2014/12/05
TLS
ãƒªãƒ³ã‚¯
1