[B! ssl] rightgo09ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

rightgo09 id:rightgo09

sslã«é–¢ã™ã‚‹rightgo09ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Nginxã§HTTPSï¼šã‚¼ãƒã‹ã‚‰å§‹ã‚ã¦SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹ã¾ã§ Part 2 â€“ è¨å®šã€Ciphersuiteã€ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ | POSTD
Nginxã§HTTPSï¼šã‚¼ãƒã‹ã‚‰å§‹ã‚ã¦SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹ã¾ã§ Part 2 â€“ è¨å®šã€Ciphersuiteã€ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ ä»Šæ—¥ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¸–ç•Œã§ã¯ã€ä¸€èˆ¬çš„ãªé™çš„Webã‚µã‚¤ãƒˆã‚‚å«ã‚ã€ å…¨ã¦ã®Webã‚µã‚¤ãƒˆ ã«ã€å¼·å›ºã§å®‰å…¨ãªHTTPSã®ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ãŒå¿…è¦ã¨ãªã‚Šã¾ã™ã€‚ã“ã®è¨˜äº‹ã¯ã€Nginx ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ã©ã®ã‚ˆã†ã«ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã™ã‚‹ã®ã‹ã«é–¢ã™ã‚‹ã‚·ãƒªãƒ¼ã‚ºã®ãƒ‘ãƒ¼ãƒˆ2ã§ã™ã€‚ ãƒ‘ãƒ¼ãƒˆ1 ã¯ã€Webã‚µãƒ¼ãƒã«æœ‰åŠ¹ãªç½²åè¨¼æ˜Žæ›¸ã‚’ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã™ã‚‹è©±ã§çµ‚äº†ã—ã¾ã—ãŸã€‚ã—ã‹ã—ã“ã‚Œã«ã¯ã€æœ€é©ãªè¨å®šã¨ã¯è¨€ã„é›£ã„ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®Nginxã®è¨å®šã‚’ä½¿ç”¨ã—ã¦ã„ã¾ã—ãŸã€‚ ã“ã®è¨˜äº‹ã‚’èªã¿çµ‚ãˆã‚Œã°ã€SSL Labsã®ãƒ¬ãƒãƒ¼ãƒˆã§ã€A+ã®è©•ä¾¡ã‚’ç²å¾—ã§ãã‚‹å®‰å…¨ãªHTTPSã®è¨å®šãŒã§ãã¾ã™ã€‚ãã‚Œã ã‘ã§ãªãã€è¿½åŠ ã§ã„ãã¤ã‹ã®å¾®èª¿æ•´ã‚‚è¡Œã„ã€ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ãã—ã¦UXã‚‚å‘ä¸Šã•ã›ã¦ã„ãã¾ã™ã€‚ ã“ã“ã«æŽ²è¼‰ã—ãŸè¨˜è¿°ã‚„ã‚³ãƒ¼ãƒ‰ã®æŠœç²‹ã®ä»–ã«ã‚‚ã€ã™ãã«ä½¿
rightgo09 2017/07/25
ssl

TLS

https

nginx

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
æœ¬å½“ã¯æ€–ã„AES-GCMã®è©± - ã¼ã¡ã¼ã¡æ—¥è¨˜
Disclaimer æœ¬ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã¯ã€ã“ã®å¤ blackhat usa 2016ã§è¡Œã‚ã‚Œã‚‹äºˆå®šã®è¬›æ¼”ã€ŒNONCE-DISRESPECTING ADVERSARIES: PRACTICAL FORGERY ATTACKS ON GCM IN TLSã€ ã®ãƒã‚¿ãƒãƒ¬ã‚’å«ã‚“ã§ã„ã¾ã™ã€‚ç¾åœ°ã§ç›´æŽ¥èžãæ–¹ã¯èªã¾ãªã„ã‚ˆã†æ°—ã‚’ã¤ã‘ã¦ä¸‹ã•ã„ã€‚ 0. çŸã„ã¾ã¨ã‚ ä»Šå›žã¯çŸã‚ã«ã¨æ€ã£ãŸã®ã§ã™ãŒã€ã‚„ã£ã±ã‚Šãã‚Œãªã‚Šã®åˆ†é‡ã§ã—ãŸã€‚ãªã®ã§çŸã„ã¾ã¨ã‚ã‚’æ›¸ã„ã¦ãŠãã¾ã™ã€‚ 4åƒä¸‡ä»¥ä¸Šã®ã‚µã‚¤ãƒˆå¯¾ã—ã¦AES-GCMä½¿ã£ãŸTLSé€šä¿¡ã®åˆæœŸãƒ™ã‚¯ãƒˆãƒ«(IV)ãƒ‡ãƒ¼ã‚¿ã®ã‚µãƒ¼ãƒ™ã‚¤ãŒè¡Œã‚ã‚Œã€7ä¸‡ç¨‹ã®ã‚µã‚¤ãƒˆã§IVã®å€¤ãŒå†åˆ©ç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚IVãŒå†åˆ©ç”¨ã•ã‚ŒãŸå ´åˆã€AES-GCMã®å®‰å…¨æ€§ã¯è‡´å‘½çš„ãªå½±éŸ¿ã‚’å—ã‘ã¾ã™ã€‚IVã®å†åˆ©ç”¨ãŒåˆ¤æ˜Žã—ãŸå¹¾ã¤ã‹å®Ÿè£…ã‹ã‚‰æ—¢ã«è„†å¼±æ€§ã®ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ãŒå‡ºã¦ã„ã¾ã™ã€‚ IVãŒå†åˆ©ç”¨ã•ã‚ŒãŸå ´åˆã€ç¾å®Ÿçš„ã«HTTPS
rightgo09 2017/07/25
TLS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ssl
ãƒªãƒ³ã‚¯
éŒ†ã³ã¤ã„ãŸTLSã‚’æ»‘ã‚‰ã‹ã«ã€Googleã«ã‚ˆã‚‹GREASEè©¦é¨“ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ é•·ã„é–“ã€TLSã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ»ã‚µãƒ¼ãƒé–“ã§ä½¿ç”¨ã™ã‚‹TLSãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’åˆæ„ã™ã‚‹éš›ã«ã€ ä¸å®Œå…¨ãªã‚µãƒ¼ãƒå®Ÿè£…ã«ã‚ˆã£ã¦ version intolerance ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒå•é¡Œã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ TLS1.3ã§ã¯ã“ã® version intolerance ã®å½±éŸ¿ã‚’æœ€å°åŒ–ã™ã‚‹ãŸã‚ã€æ–°ã—ã„ version negotiation ã®ä»•çµ„ã¿ã‚’å–ã‚Šå…¥ã‚Œã¾ã—ãŸã€‚ Googleã¯ã€GREASE(Generate Random Extensions And Sustain Extensibility)ã¨ã„ã†ä»•æ§˜ã‚’Chromeã«å®Ÿè£…ã—ã€TLSã‚µãƒ¼ãƒã®ãƒã‚°ã§é€šã‚‰ãªã„æ‹¡å¼µã‚„ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰å€¤ã§å•é¡ŒãŒç™ºç”Ÿã—ãªã„ã‹è©¦é¨“ã‚’å§‹ã‚ã¾ã—ãŸã€‚ ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ãŒå¥½ããªäººã¯ã€ChromeãŒ 0x[0-f]a0x[0-f]a ã®è¦‹æ…£ã‚Œãªã„å€¤ã‚’CipherSuiteã‚„TLSæ‹¡å¼µã«ä½¿ã£ã¦ã„ã‚‹ã®ã‚’è¦‹ã¤ã‘ã¦ã‚‚é©šã‹ãªã„ã‚ˆã†æ°—ã‚’
rightgo09 2016/10/03
SSL

TLS

tls1.3
ãƒªãƒ³ã‚¯
OpenSSL: Manually verify a certificate against an OCSP - Raymii.org
OpenSSL: Manually verify a certificate against an OCSP Published: 07-04-2014 | Author: Remy van Elst | Text only version of this article â— This post is over ten years old. It may no longer be up to date. Opinions may have changed. This article shows you how to manually verfify a certificate against an OCSP server. OCSP stands for the Online Certificate Status Protocol and is one way to validate a
rightgo09 2016/09/28
OpenSSL

SSL

OCSP
ãƒªãƒ³ã‚¯
Ubuntu ã§ Apache 2.2 ã§ãƒžãƒ«ãƒãƒ‰ãƒ¡ã‚¤ãƒ³ SSL ã‚’è¨å®šã™ã‚‹ã«ã¯ - tilfin's note è·¡åœ°
ãƒžãƒ«ãƒãƒ‰ãƒ¡ã‚¤ãƒ³SSLè¨¼æ˜Žæ›¸ã¯æœ¬æ¥IPã‚¢ãƒ‰ãƒ¬ã‚¹ã”ã¨ã«1FQDNã ã£ãŸ SSL ãƒ›ã‚¹ãƒˆã‚’ã€1IPã‚¢ãƒ‰ãƒ¬ã‚¹ã§è¤‡æ•°ã®FQDNã«å¯¾å¿œã•ã›ã‚‹ã‚‚ã®ã§ã™ã€‚ è¦ã™ã‚‹ã«httpsã§ã‚‚åå‰ãƒ™ãƒ¼ã‚¹ã®ãƒãƒ¼ãƒãƒ£ãƒ«ãƒ›ã‚¹ãƒˆãŒä½¿ãˆã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ Apache 2.2.12 ä»¥é™ã§ SNIï¼ˆServer Name Indicationï¼‰ã¨ã„ã† SSLãƒ—ãƒãƒˆã‚³ãƒ«ã«å¯¾ã™ã‚‹æ‹¡å¼µæ©Ÿèƒ½ãŒã‚µãƒãƒ¼ãƒˆã•ã‚Œã€ãã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãŒ mod_gnutls ã«ãªã‚Šã¾ã™ã€‚ ãŸã Server Name Indication - Wikipedia, the free encyclopedia ã«ã‚ã‚‹é€šã‚Šã€SNI ã¯ Windows XP ã® IE ã§ã¯ã‚µãƒãƒ¼ãƒˆã•ã‚Œãªã„ãªã©ã€ã¾ã ã¾ã ä¸€èˆ¬çš„ä½¿ã†ã«ã¯æ—©ãã†ã§ã™ã€‚ ä»Šå›žã€ã•ãã‚‰ VPS ã‚µãƒ¼ãƒã® Ubuntu ä¸Šã§ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã—ãŸã®ã§ã¾ã¨ã‚ã¦ãŠãã¾ã™ã€‚ mod_gnutls ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãƒ»é©ç”¨ # apt
rightgo09 2013/07/10
ubuntu

apache

ssl
ãƒªãƒ³ã‚¯
crazybob.org: Android: Trusting SSL certificates
We use a self-signed SSL certificate for the test version of our backend web service. Since our certificate isn't signed by a CA that Android trusts by default, we need to add our server's public certificate to our Android app's trusted store. These same instructions apply to trusting a custom CA, except you'd get the public certificate directly from the CA instead of from a server. Required tools
rightgo09 2013/06/03
Android

ssl
ãƒªãƒ³ã‚¯
ãƒ¢ãƒã‚¤ãƒ«ã‚¦ã‚§ãƒ–ç’°å¢ƒã®HTTPSã®ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚° Â« NAVER Engineers' Blog
ã“ã‚“ã«ã¡ã¯æ¤œç´¢ã‚µãƒ¼ãƒ“ã‚¹é–‹ç™ºï¼”ãƒãƒ¼ãƒ ã®å´”ç‰ç§€ã¨ç”³ã—ã¾ã™ã€‚ ã‚¤ãƒ³ãƒ•ãƒ©ã‚„ã‚·ã‚¹ãƒ†ãƒ ã¨ã®é€£æºã‚„çµ±è¨ˆã®ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã‚’æ‹…å½“ã—ã¦ãŠã‚Šã¾ã™ã€‚ ãƒ¢ãƒã‚¤ãƒ«ã®ã‚¦ã‚§ãƒ–ç’°å¢ƒã¯PCã®ã‚¦ã‚§ãƒ–ä½¿ç”¨ç’°å¢ƒã¨ã¯è‰²ã€…ãªé•ã„ãŒæœ‰ã‚Šã¾ã™ã€‚ ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã®é€Ÿåº¦ã ã‘ã§ã¯ãªããƒãƒƒãƒ†ãƒªãƒ¼ã®åŠ¹çŽ‡ã‚’è€ƒãˆãŸä»•çµ„ã¿ãªã©ã€PCã«æ¯”ã¹ãƒªã‚½ãƒ¼ã‚¹ãŒååˆ†ã§ã¯ãªã„ãŸã‚ãƒ¢ãƒã‚¤ãƒ«ãƒ–ãƒ©ã‚¦ã‚¶ã®å‹•ä½œãŒç•°ãªã£ã¦ã„ã‚‹ã“ã¨ã‚‚æœ‰ã‚Šã¾ã™ã€‚ ä»Šå›žã¯ãƒ¢ãƒã‚¤ãƒ«ã®ã‚¦ã‚§ãƒ–Applicationã«ãŠã‘ã‚‹SSLé–¢ä¿‚ã®æ€§èƒ½ã«é–¢ã™ã‚‹å·¥å¤«ã®å†…å®¹ã‚’Q&Aå½¢å¼ã§è§£èª¬ã—ã¦ã„ãã¾ã™ã€‚ Q. ä½•ãŒå•é¡Œã§ã—ãŸã‹ï¼Ÿ A. ãƒ¢ãƒã‚¤ãƒ«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆ(iPhone, Android)ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‹ã‚‰ã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã®å¿œç”æ™‚é–“ã«é…å»¶ã®å•é¡ŒãŒæœ‰ã‚Šã¾ã™ã€‚ æœ€åˆã¯web access logã‹ã‚‰ã®slow response(ï¼‘ç§’ä»¥ä¸Š)ã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆãŒçµæ§‹ã‚ã‚Šã¾ã—ãŸã€‚ ãã®HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’protoc
rightgo09 2011/10/27
ãƒ¢ãƒã‚¤ãƒ«

ssl
ãƒªãƒ³ã‚¯
1