[B! SSL] uokadaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

uokada id:uokada

SSLã«é–¢ã™ã‚‹uokadaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

XCAã§ãƒãƒ¼ã‚«ãƒ«CAã‚’ç«‹ã¦ã¦ã€ãƒãƒƒãƒ”ãƒ¼SSLãƒ©ã‚¤ãƒ• - Qiita
é–‹ç™ºã‚µãƒ¼ãƒã§ã‚½ãƒ•ãƒˆã‚’å‹•ã‹ã™ã¨ãã«ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ãŒå¿…è¦ã«ãªã‚‹ã¨ãã£ã¦ã‚ã‚Šã¾ã™ã‚ˆãã€‚ ä»Šè©±é¡Œã®HTTP/2ã‚’è©¦ã™ã«ã¯SSLé€šä¿¡ãŒå¿…é ˆã ã£ãŸã‚Šã—ã¾ã™ã—ã€‚ ã‚‚ã¡ã‚ã‚“OSã‚„ã‚½ãƒ•ãƒˆã«ã¤ã„ã¦ãã‚‹ã‚µãƒ³ãƒ—ãƒ«ç”¨ã®è¨¼æ˜Žæ›¸ã§ã‚‚SSLé€šä¿¡ã¯ã§ãã‚‹ã‘ã©ã€è¨¼æ˜Žæ›¸ãŒæ¤œè¨¼ã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ã‚ã‘ã§ãƒ–ãƒ©ã‚¦ã‚¶ã®è¦å‘Šç”»é¢ãŒé¬±é™¶ã—ã„ã—ã€æ¤œè¨¼ã‚¨ãƒ©ãƒ¼ã‚’ç„¡è¦–ã™ã‚‹ãŸã‚ã®è¨å®šå¤‰æ›´ã‚’ã™ã‚‹å¿…è¦ãŒã‚ã‚‹å ´åˆã‚‚ã‚ã‚Šã¾ã™ã€‚ ã‹ã¨ã„ã£ã¦ã€ã‚ã–ã‚ã–é–‹ç™ºã‚µãƒ¼ãƒã®ãŸã‚ã«SSLè¨¼æ˜Žæ›¸ã¯è²·ãˆãªã„ã—â€¦ã€‚ ãã‚“ãªã¨ãã®æ•‘ä¸–ä¸»ãŒLet's Encryptã§ã€ç„¡æ–™ã§æ£è¦ã®SSLè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã—ã¦ãã‚Œã‚‹ã‚ã‚ŠãŒãŸã„å˜åœ¨ã§ã™ã€‚ ã—ã‹ã—ã€Let's Encryptã§SSLè¨¼æ˜Žæ›¸ç™ºè¡Œã™ã‚‹ãŸã‚ã«ã¯ãƒ‰ãƒ¡ã‚¤ãƒ³ãŒDNSç™»éŒ²ã•ã‚Œã¦ã„ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã®ã§ã€ç¤¾å†…ï¼ˆçµ„ç¹”ã€è‡ªå®…ï¼‰å†…ã®å†…éƒ¨ã§ä½¿ã£ã¦ã‚‹"abc.localdomain"ã¿ãŸã„ãªãƒ‰ãƒ¡ã‚¤ãƒ³ã«ã¯å¯¾å¿œã—ã¦ã¾ã›ã‚“ã€‚ çµå±€ã€è‡ªå‰ã§Local CAã‚’é‹å–¶ã™ã‚‹å¿…è¦ãŒ
uokada 2024/09/09
SSL

openssl
ãƒªãƒ³ã‚¯
Amazon RDS now supports new SSL/TLS certificates and certificate controls
Amazon Relational Database Service (Amazon RDS) has new certificate authorities with 40 year and 100 year validity. SSL/TLS certificates enable secure communication between your clients and databases. Administrators can control which certificate their organization uses by setting a default certificate per account with a choice of RSA 2048, RSA4096, and ECC384. When provisioning and modifying a dat
uokada 2024/01/19
aws

rds

SSL

security
ãƒªãƒ³ã‚¯
Rotating your SSL/TLS certificate - Amazon Relational Database Service
Amazon RDS Certificate Authority certificates rds-ca-2019 expired in August, 2024. If you use or plan to use Secure Sockets Layer (SSL) or Transport Layer Security (TLS) with certificate verification to connect to your RDS DB instances or Multi-AZ DB clusters, consider using one of the new CA certificates rds-ca-rsa2048-g1, rds-ca-rsa4096-g1 or rds-ca-ecc384-g1. If you currently do not use SSL/TLS
uokada 2021/08/24
SSL

rds

aws
ãƒªãƒ³ã‚¯
Mozilla Observatory
ðŸ“£ï¸Ž Heads up! New security scoring standards apply - Your website grade may have changed. MDN Observatory will launch soon. Learn More. The Mozilla Observatory has helped over 240,000 websites by teaching developers, system administrators, and security professionals how to configure their sites safely and securely.
uokada 2020/11/09
webservice

SSL

security

mozilla
ãƒªãƒ³ã‚¯
å¹…åºƒã„ç’°å¢ƒã§SSLå¯¾å¿œã™ã‚‹ãŸã‚ã«çŸ¥ã£ã¦ãŠãã¹ãã“ã¨
- SSLé–¢é€£ã®éšœå®³ãŒãªãœèµ·ãã¦ã—ã¾ã†ã®ã‹ï¼Ÿ - ä½•ã§å¯¾å¿œç«¯æœ«ãŒå¤‰ã‚ã‚‹ã®ã‹ - ä½•ã‚’ã™ã‚Œã°éšœå®³ã‚’é˜²ã’ã‚‹ã®ã‹ï¼Ÿ - SSLå¯¾å¿œã™ã‚‹ãŸã‚ã«ã©ã†ã„ã†ä½“åˆ¶ã‚’çµ„ã‚“ã§ã„ãŸã‚‰ã„ã„ã®ã‹ï¼Ÿ ãŠã“ã¨ã‚ã‚Š: ç¤¾å†…å‘ã‘å‹‰å¼·ä¼šã®ã‚¹ãƒ©ã‚¤ãƒ‰ã‚’å†ç·¨é›†ã—ãŸã‚‚ã®ã§ã™ã€‚ç¤¾å¤–å‘ã‘ã«å‰²æ„›ã—ãŸçµæžœã€ã¡ãã¯ãã«ãªã£ã¦ã„ã‚‹éƒ¨åˆ†ãŒã‚ã‚Šã¾ã™ã€‚
uokada 2020/02/09
ã‚ã¨ã§èªã‚€

SSL

security
ãƒªãƒ³ã‚¯
Wiresharkã§SSLé€šä¿¡ã®ä¸èº«ã‚’è¦—ã„ã¦ã¿ã‚‹ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
OpenSSLã®è„†å¼±æ€§ã€ŒHeartbleedã€ãŒä¸–é–“ã‚’è³‘ã‚ã›ã¦ã„ã¾ã™ãŒã€è‰²ã€…ã¨ä¹—ã‚Šé…ã‚Œã¦ã—ã¾ã£ãŸæ„ŸãŒã‚ã‚‹ã®ã§ã€ã‚†ã‚‹ã‚†ã‚‹ã¨è½ã¡ç©‚æ‹¾ã„ã‚’ã—ã‚ˆã†ã‹ã¨æ€ã„ã¾ã™ã€‚ Heartbleedã§ç§˜å¯†éµã‚’æ‰‹ã«å…¥ã‚ŒãŸã‚‰SSLé€šä¿¡ã®ä¸èº«å…¨éƒ¨è¦‹ãˆã¡ã‚ƒã†ã˜ã‚ƒã‚“!! ã¨ã„ã†äº‹æ…‹ã«ãªã£ã¦ã„ã¾ã™ãŒã€ãªã‚“ã¨ãªãç†è«–çš„ã«ãã†ã ã‚ã†ãªã¨åˆ†ã‹ã‚‹ã‚‚ã®ã®ã‚¤ãƒžã‚¤ãƒå…·ä½“çš„ãªæ‰‹é †ãŒåˆ†ã‹ã‚‰ãªã„ã€‚ ã¨ã„ã†ã‚ã‘ã§ä»Šå›žã®ãƒ†ãƒ¼ãƒžã¨ã—ã¦ã€æ‰‹å…ƒã«ã‚µãƒ¼ãƒã®ç§˜å¯†éµã¨ã€SSLé€šä¿¡ã‚’ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã—ãŸpcapãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚ã‚‹ã¨ãã«ã€Wiresharkã§ã©ã‚“ãªæ„Ÿã˜ã§SSLé€šä¿¡ã‚’ã€Œã»ã©ãã€ã®ã‹â€¦â€¦ã¨ã„ã†å…·ä½“çš„ãªæ‰‹é †ã‚’ã€ãƒãƒžã‚Šæ‰€ã‚’å«ã‚ã¦ã¾ã¨ã‚ã¦ãŠã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ ã¨ã„ã†ã‹ã€ç§è‡ªèº«ãŒãƒãƒžã£ãŸã®ã§è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã§ã™ãªã€‚ãªãŠã“ã®æ–‡æ›¸ã§ã¯"SSL"ã¨ã ã‘è¨˜è¿°ã—ã€TLSã¯ç„¡è¦–ã—ã¦ã„ã¾ã™ã€‚ å‰ææ¡ä»¶ ã¨ã‚Šã‚ãˆãšä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã®æ¤œè¨¼ç’°å¢ƒã§è©¦ã—ã¾ã—ãŸã€‚ IPã‚¢ãƒ‰ãƒ¬ã‚¹ èª¬æ˜Ž ãƒ›ã‚¹ãƒˆO
uokada 2019/01/24
wireshark

SSL

openssl
ãƒªãƒ³ã‚¯
OpenSSL #ccsinjection Vulnerability
[English] æœ€çµ‚æ›´æ–°æ—¥: Mon, 16 Jun 2014 18:21:23 +0900 CCS Injection Vulnerability æ¦‚è¦ OpenSSLã®ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«æ¬ é™¥ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚ŒãŸå ´åˆã€æš—å·é€šä¿¡ã®æƒ…å ±ãŒæ¼ãˆã„ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ä¸¡æ–¹ã«å½±éŸ¿ãŒã‚ã‚Šã€è¿…é€Ÿãªå¯¾å¿œãŒæ±‚ã‚ã‚‰ã‚Œã¾ã™ã€‚ æ”»æ’ƒæ–¹æ³•ã«ã¯å……åˆ†ãªå†ç¾æ€§ãŒã‚ã‚Šã€æ¨™çš„åž‹æ”»æ’ƒç‰ã«åˆ©ç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ã¯éžå¸¸ã«é«˜ã„ã¨è€ƒãˆã¾ã™ã€‚ å¯¾ç– å„ãƒ™ãƒ³ãƒ€ã‹ã‚‰æ›´æ–°ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹ã¨æ€ã‚ã‚Œã‚‹ã®ã§ã€ãã‚Œã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ã“ã¨ã§å¯¾ç–ã§ãã¾ã™ã€‚ ï¼ˆéšæ™‚æ›´æ–°ï¼‰ Ubuntu Debian FreeBSD CentOS Red Hat 5 Red Hat 6 Amazon Linux AMI åŽŸå› OpenSSLã®ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«ç™ºè¦‹
uokada 2014/06/05
openssl

SSL

security
ãƒªãƒ³ã‚¯
çŸã„æš—å·éµé•·ã€ŒECCã€ã§ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ä¸¡ç«‹å›³ã‚‹ãƒ™ãƒªã‚µã‚¤ãƒ³
SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã«ãŠã„ã¦æ¨™æº–ã¨ãªã£ã¦ã„ã‚‹RSAã«åŠ ãˆã€ã€ŒECCï¼ˆElliptic Curve Cryptographyï¼šæ¥•å††æ›²ç·šæš—å·ï¼‰ã€ã¨ã€ŒDSAï¼ˆDigital Signature Algorithm:ãƒ‡ã‚¸ã‚¿ãƒ«ç½²åï¼‰ã€ã¨ã„ã†2ã¤ã®æš—å·ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®æä¾›ã‚’é–‹å§‹ã—ãŸãƒ™ãƒªã‚µã‚¤ãƒ³ã€‚ãã®èƒŒæ™¯ã¨ç‹™ã„ã¨ã¯ï¼Ÿ 2ã¤ã®ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã«å¯¾å¿œã—ãŸSSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚·ãƒ§ãƒƒãƒ”ãƒ³ã‚°ã‚µã‚¤ãƒˆã§ä½•ã‹ã‚’è³¼å…¥ã™ã‚‹ã¨ãã€ã‚ã‚‹ã„ã¯æ–°ã—ã„Webã‚µãƒ¼ãƒ“ã‚¹ã«ä¼šå“¡ç™»éŒ²ã™ã‚‹ã¨ãâ€¦â€¦æˆ‘ã€…ã¯å½“ãŸã‚Šå‰ã®ã‚ˆã†ã«æš—å·åŒ–æŠ€è¡“ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ã€‚å®Ÿã¯ã€ã“ã®Webã®æš—å·åŒ–æŠ€è¡“ã®è£ã§ã¯ã€ã•ã¾ã–ã¾ãªæš—å·ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ãŒæ´»ç”¨ã•ã‚Œã¦ã„ã‚‹ã€‚ æ—¥æœ¬ãƒ™ãƒªã‚µã‚¤ãƒ³ã¯2æœˆ14æ—¥ã€ã“ã‚Œã‚‰æš—å·åŒ–é€šä¿¡ã®åŸºç›¤ã§ã‚ã‚‹SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã®å¯¾å¿œã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®æ‹¡å¼µã‚’ç™ºè¡¨ã—ãŸã€‚å…·ä½“çš„ã«ã¯ã€ã€ŒECCï¼ˆElliptic Curve Cryptographyï¼šæ¥•å††æ›²ç·šæš—å·ï¼‰ã€ã¨ã€ŒDSAï¼ˆDi
uokada 2014/01/15
Googleã¯ECC 256 bitä½¿ã£ã¦ã‚‹ã®ã‹ã€‚ãªã‚“ã‹çŸã„ã®ã¤ã‹ã£ã¦ã‚‹ãªã¨æ€ã£ãŸã‚‰æ™®é€šã®ã§ã¯ãªã„ã®ã‹ã€‚

RSA

algorithm

security

SSL
ãƒªãƒ³ã‚¯
FacebookãŒSPDYã‚’å§‹ã‚ã¾ã—ãŸï¼ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. SPDYãŒç†±ã„ã§ã™ï¼ ã¡ã‚‡ã†ã©å…ˆé€±æœ«CROSS2013ã® æ¬¡ä¸–ä»£Webã‚»ãƒƒã‚·ãƒ§ãƒ³(ãƒ—ãƒãƒˆã‚³ãƒ«ç·¨) ã«ãƒ‘ãƒãƒ©ãƒ¼ã¨ã—ã¦å‚åŠ ã•ã›ã¦ã„ãŸã ãã¾ã—ãŸã€‚ æ¬¡ä¸–ä»£Webã®éµã¨ãªã‚‹WebSocketãƒ»SPDYãƒ»HTTP/2.0ã«ã¤ã„ã¦ç†±ã„è©±ãŒã§ãã¨ã¦ã‚‚æº€è¶³ã—ã¦ã„ã¾ã™ã€‚ä¼šå ´ã¯æº€å“¡ã§çš†ã•ã‚“ãŒã¨ã¦ã‚‚èˆˆå‘³ã‚’æŒã£ã¦èžã„ã¦ã„ãŸã ã„ã¦ã„ã‚‹ã®ã‚‚ååˆ†æ„Ÿã˜ã‚‹ã“ã¨ãŒã§ãã¾ã—ãŸã€‚ å‚åŠ ã—ã¦ã„ãŸã ã„ãŸæ–¹ã€æœ¬å½“ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã—ãŸã€‚ 2. LINEãŒSPDYã‚’ä½¿ã£ã¦ã„ã‚‹ ã‚»ãƒƒã‚·ãƒ§ãƒ³ã§ã¯ã€ã¤ã„æœ€è¿‘ LINE ãŒ SPDY ã‚’ä½¿ã£ã¦ã„ã‚‹ã¨ã„ã†ç™ºè¡¨( http://tech.naver.jp/blog/?p=2381 )ã«ã¤ã„ã¦ç´¹ä»‹ã—ã€ãã®æœ‰ç”¨æ€§ã«ã¤ã„ã¦ã„ãã¤ã‹ã‚³ãƒ¡ãƒ³ãƒˆã‚’ã—ã¾ã—ãŸã€‚ SPDYã¯ã€ Google ãŒ2011å¹´ã‚ˆã‚Š2å¹´è¿‘ãã»ã¨ã‚“ã©ã®Googleã‚µãƒ¼ãƒ“ã‚¹ã§å®Ÿé‹ç”¨ã—ã¦ã„ã¾ã™ãŒã€Googleä»¥å¤–ã§ä¸–ç•Œçš„ã«ãƒ¡ã‚¸ãƒ£ãƒ¼ãªå¤§è¦æ¨¡ã®
uokada 2013/08/12
SPDY

google

facebook

SSL
ãƒªãƒ³ã‚¯
1