Chrome’s Plan to Distrust Symantec CertificatesThe latest news and insights from Google on security and safety on the Internet
ssl_logger/README.md at master · google/ssl_logger
geffner@ubuntu:~$ # Make a local pipe for input to our openssl client geffner@ubuntu:~$ mkfifo pipe geffner@ubuntu:~$ # Create our openssl client, which will receive input from our pipe geffner@ubuntu:~$ openssl s_client -ign_eof -connect example.org:443 > /dev/null 2> /dev/null < pipe & [1] 98954 geffner@ubuntu:~$ # Begin writing the request to our pipe geffner@ubuntu:~$ printf "GET / HTTP/1.0\nH
独自ドメインã®ã‚·ãƒ§ãƒƒãƒ—ã§httpsã§ã‚¢ã‚¯ã‚»ã‚¹ã§ãるよã†ã«ãªã‚Šã¾ã—㟠- BASEプãƒãƒ€ã‚¯ãƒˆãƒãƒ¼ãƒ ブãƒã‚°
SREãƒãƒ¼ãƒ ã®å°æž—（ã—）ã§ã™ã€‚ BASEã§ã¯ç‹¬è‡ªãƒ‰ãƒ¡ã‚¤ãƒ³ã§é‹ç”¨ã•ã‚Œã¦ã„るショップã•ã‚“ã§HTTPSã§è¡¨ç¤ºã§ãる機能を実装ã—ã¾ã—ãŸã€‚ 「BASEã€ãŒç‹¬è‡ªãƒ‰ãƒ¡ã‚¤ãƒ³ã®SSL証明書ã®ç„¡æ–™ç™ºè¡Œãƒ»è‡ªå‹•ç®¡ç†ã‚’開始　â€å¸¸æ™‚SSLã§å®‰å¿ƒå®‰å…¨ãªãƒãƒƒãƒˆã‚·ãƒ§ãƒƒãƒ—é‹å–¶ã‚’ 去年ã®3月ã«ã‚µãƒ–ドメインã§é‹ç”¨ã•ã‚Œã¦ã„るショップã•ã‚“ã«é–¢ã—ã¦ã¯å…¨ã¦HTTPS化ã¯å®Ÿè£…ã—ã¦ã„ã¾ã—ãŸãŒã€ç‹¬è‡ªãƒ‰ãƒ¡ã‚¤ãƒ³ã§è¡¨ç¤ºã•ã‚Œã¦ã„るショップã•ã‚“ã¯HTTPã®è¡¨ç¤ºã®ã¾ã¾ã§ã—ãŸã€‚今回ã‹ã‚‰ç‹¬è‡ªãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’利用ã•ã‚Œã¦ã„るショップã•ã‚“ã‚‚HTTPSã§ã‚¢ã‚¯ã‚»ã‚¹ãŒå¯èƒ½ã¨ãªã‚Šã€å…¨ã¦ã®ã‚·ãƒ§ãƒƒãƒ—ã•ã‚“ã§HTTPSã§ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒå¯èƒ½ã¨ãªã‚Šã¾ã™ã€‚ 今回ã®æ©Ÿèƒ½ã§ã¯HTTPSアクセスã«å¿…è¦ãªè¨¼æ˜Žæ›¸ã®å–å¾—ã¯ç„¡æ–™ã§è¡Œã„ã€ã‹ã¤ç®¡ç†ã¯åƒ•ãŸã¡ãŒã‚„ã‚Šã¾ã™ã®ã§ã‚·ãƒ§ãƒƒãƒ—ã•ã‚“ã®æ–¹ã§è¨¼æ˜Žæ›¸ã®å–得・管ç†ã¯ä¸è¦ã§ã™ã€‚ 利用方法ãªã©ã¯ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã«ãŠä»»ã›ã—ã€ä»Šå›žã¯è£å´ã®å®Ÿè£…ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ 証明書 今回証明書を発
Mozilla Security Blog 日本語版
ã“ã®è¨˜äº‹ã¯ã€2018 å¹´ 7 月 19 日付㧠Mozilla Security Blog ã«æŠ•ç¨¿ã•ã‚ŒãŸ Introducing the ASan Nightly Project （ç†è€…：decoder）ã®ç¿»è¨³ã§ã™ã€‚ã“ã®ç¿»è¨³ã¯å…¬å¼ãªã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“。詳ã—ã㯠ã“ã¡ã‚‰ ã‚’ã”覧ãã ã•ã„。 ユーザã®æ‰‹å…ƒã¸å®‰å®šã‹ã¤å®‰å…¨ãª Firefox を確実ã«å±Šã‘ã‚‹ãŸã‚〠多ãã® Mozillian ãŒé•·ã„時間をã‹ã‘ã¦æ—¥ã€…テストを行ã£ã¦ã„ã¾ã™ã€‚ ã—ã‹ã—ã€æ®‹å¿µãªã“ã¨ã«ãƒã‚°ã®ç„¡ã„プãƒãƒ€ã‚¯ãƒˆãªã©å˜åœ¨ã—ãªã„ãŸã‚〠ã©ã‚Œã»ã©ãƒ†ã‚¹ãƒˆã«åŠ›ã‚’注ã„ã§ã‚‚時ã¨ã—ã¦ãƒ–ラウザã¯ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã—ã¦ã—ã¾ã„ã¾ã™ã€‚ 実際ã«ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ãƒ¬ãƒãƒ¼ãƒˆã‚’調査ã—ã¦ã¿ã‚‹ã¨ã€ ä¸ã«ã¯å¤å…¸çš„ãªã‚»ã‚ュリティãƒã‚°ï¼ˆè§£æ”¾å¾Œä½¿ç”¨ã«ä»£è¡¨ã•ã‚Œã‚‹ãƒ¡ãƒ¢ãƒªç ´å£Šãªã©ï¼‰ã«è¦‹ãˆã‚‹ã‚‚ã®ã‚‚ã‚ã‚Šã¾ã™ã€‚ ã—ã‹ã—ã€ãã®ã‚ˆã†ãªãƒ¬ãƒãƒ¼ãƒˆã‹ã‚‰å¾—られるデータã¯ã€ ãã‚Œå˜ç‹¬ã§ã¯ä½•ã‚‚æ„味をãªã•ãªã„程度ã«ä¸å分（
SNIã§1å°ã®ã‚µãƒ¼ãƒä¸Šã«è¤‡æ•°ã®SSLサイトをé‹ç”¨ – å‰ç·¨ | ã•ãらã®ãƒŠãƒ¬ãƒƒã‚¸
ã”無沙汰ã—ã¦ãŠã‚Šã¾ã™ã€‚ç´°ç¾½ã§ã™ã€‚ 昨年ã€Androidã«ãŠã‘ã‚‹SNI対応状æ³ã¨ã„ã†è¨˜äº‹ã§ã€SSL/TLSã®æ‹¡å¼µä»•æ§˜ã§ã‚ã‚‹SNI(Server Name Indication)ã«ã¤ã„ã¦è§¦ã‚Œã¾ã—ãŸã€‚ å°‘ã—ニッãƒãªãƒ†ãƒ¼ãƒžã ã¨æ€ã£ã¦ã„ã¾ã—ãŸãŒã€ã¤ã„先日ã€ã•ãらã®ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒã§SNI SSLã‚’æ供開始ã¨ã„ã†ãƒ—レスリリースãŒç™ºè¡¨ã•ã‚Œã¾ã—ãŸã€‚広ã„サービスã§SSL/TLSå°Žå…¥ã¸ã®éœ€è¦ãŒé«˜ã¾ã£ã¦ã„る今ã€ã“ã®ã‚ˆã†ãªäº‹ä¾‹ã¯ä»Šå¾Œå¢—ãˆã¦ã„ãã‚‚ã®ã¨è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚ ãã“ã§æœ¬è¨˜äº‹ã§ã¯ã€é‡è¦åº¦ãŒé«˜ã¾ã£ã¦ã„ã‚‹SNIã«ã¤ã„ã¦ã€ãã®æŠ€è¡“ã®æ¦‚è¦ã‚’改ã‚ã¦ç†è§£ã—ã€å®Ÿéš›ã®é‹ç”¨ã«å½¹ç«‹ã¦ã‚‰ã‚Œã‚‹ã‚ˆã†ã«æ•´ç†ã‚’ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ 知è˜ã®æ•´ç†ã‚’目的ã«ã—ãŸå‰ç·¨ã¨ã€å®Ÿè·µã‚’目的ã«ã—ãŸå¾Œç·¨ã®2部構æˆã§ãŠå±Šã‘ã—ã¾ã™ã€‚ 以下ãŒå‰ç·¨ã®å†…容ã§ã™ã€‚ SNIã§ä½•ãŒå‡ºæ¥ã‚‹ã‚ˆã†ã«ãªã‚‹ã®ã‹ SNIã§è¤‡æ•°ãƒ‰ãƒ¡ã‚¤ãƒ³ãŒé‹ç”¨å¯èƒ½ã«ãªã‚‹ã¾ã§ SNIãŒé‡è¦ã«ãªã‚Šã¤ã¤ã‚る背景 SSLé‹
Web開発者ãŒæらã知らãªã„ã€SSLã«ã¤ã„ã¦çŸ¥ã£ã¦ãŠãã¹ãã“㨠| POSTD
2015å¹´ã€Web開発者ã¯ä»¥å‰ã‚ˆã‚Šã‚‚SSLã«é–¢ã™ã‚‹ç†è§£ã‚’æ·±ã‚ã¦ã„ã¾ã™ã€‚ãã†ã—ãŸWeb開発者ãŸã¡ãŒHacker Newsã‚’èªã‚€ãªã‚‰çŸ¥ã£ã¦ãŠãã¹ãã“ã¨ã‚’以下ã«æŒ™ã’ã¦ã¿ã¾ã™ã€‚ ドメインèªè¨¼ï¼ˆDV）証明書㯠Let’s Encrypt ã‹ã‚‰ç„¡æ–™ã§å–å¾—ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã€‚ æ‹¡å¼µèªè¨¼ï¼ˆEV）証明書 㯠CertSimple ã‹ã„ãã¤ã‹ã®ãƒã‚§ãƒƒã‚¯ã®ã®ã¡ã®æ”¯æ‰•ã„ã§å–å¾—ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã€‚ã“ã‚ŒãŒæˆ‘々ã®ã‚„り方。 Mozilla SSL Config Generator を使用ã™ã‚Œã°ã€ã‚µãƒãƒ¼ãƒˆã—ãŸã„ブラウザã«å¯¾ã—ã¦ã€ã‚µãƒ¼ãƒã‚’å¯èƒ½ãªé™ã‚Šå®‰å…¨ã«è¨å®šã™ã‚‹ã“ã¨ãŒå¯èƒ½ã€‚ 完了後㫠SSL Labs を使ã£ã¦å…¨ã¦ã‚’ãƒã‚§ãƒƒã‚¯ã—ã€A評価ç²å¾—を確èªã—ã¾ã—ょã†ã€‚ãã†ã§ãªã‘ã‚Œã°äººã«å°è¨€ã‚’言ã‚ã‚Œã¾ã™ã€‚ ãã®ä»–ã¯ã©ã†ã§ã—ょã†ã‹ã€‚我々ã®é¡§å®¢ã‹ã‚‰å¯„ã›ã‚‰ã‚Œã‚‹æœ€ã‚‚多ã„質å•ã«ã¤ã„ã¦ã€å›žç”を紹介ã—ã¦ã„ãã¾ã—ょã†ã€‚ 1. Chromeã§â€å¤ã„æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆâ€ã‚’
InfoQ: HTTPSコãƒã‚¯ã‚·ãƒ§ãƒ³ã®æœ€åˆã®æ•°ãƒŸãƒªç§’
ã»ã¨ã‚“ã©ã®äººãŒHTTPSã¨SSL (Secure Sockets Layer) ã‚’çµã³ã¤ã‘ã¦è€ƒãˆã¾ã™ã€‚SSLã¯1990年代åŠã°ã«Netscape社ãŒé–‹ç™ºã—ãŸä»•çµ„ã¿ã§ã™ãŒã€ä»Šã§ã¯ã“ã®äº‹å®Ÿã¯ã‚ã¾ã‚Šæ£ç¢ºã§ãªã„ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“。Netscape社ãŒå¸‚å ´ã®ã‚·ã‚§ã‚¢ã‚’失ã†ã«ã—ãŸãŒã£ã¦ã€SSLã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“タスクフォース(IETF)ã¸ç§»ç®¡ã•ã‚Œã¾ã—ãŸã€‚Netscape社ã‹ã‚‰ç§»ç®¡ã•ã‚Œã¦ä»¥é™ã®åˆã‚ã¦ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯Transport Layer Security (TLS)1.0ã¨å付ã‘られã€1999å¹´1月ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚TLSãŒä½¿ã‚ã‚Œã ã—ã¦10年も経ã£ã¦ã„ã‚‹ã®ã§ã€ç´”粋ãª"SSL"ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’見るã“ã¨ã¯ã»ã¨ã‚“ã©ã‚ã‚Šã¾ã›ã‚“。 Client Hello TLSã¯ã™ã¹ã¦ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ç•°ãªã‚‹ã‚¿ã‚¤ãƒ—ã®"レコード"ã§åŒ…ã¿ã¾ã™ã€‚ブラウザãŒå‡ºã™å…ˆé ã®ãƒã‚¤ãƒˆå€¤ã¯16進数表記ã§0x16 = 22。 ã“ã‚Œã¯
Security/Server Side TLS - MozillaWiki
The ordering of cipher suites in the Old configuration is very important, as it determines the priority with which algorithms are selected. OpenSSL will ignore cipher suites it doesn't understand, so always use the full set of cipher suites below, in their recommended order. The use of the Old configuration with modern versions of OpenSSL may require custom builds with support for deprecated ciphe
Nginxã§SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹æ‰‹é †
昨日 HTTPS 化ã—㟠シャンプー評価サイト ã®SSL評価をA+ã«ã—ã¾ã—ãŸã€‚ å‚考ã«ã—ãŸã®ã¯ä¸‹ã®è¨˜äº‹ HTTPS on Nginx: From Zero to A+ (Part 2) - Configuration, Ciphersuites, and Performance - Julian Simioni ã“ã®è¨˜äº‹ã®Nginx証明書è¨å®šã‚’POSTDã•ã‚“ãŒç¿»è¨³ã—ã¦ã„ã‚‹ã®ã§ã€è¿‘ã„ã†ã¡ã«è©³ã—ã„訳ã¯æ—¥æœ¬èªžã§èªã‚ã‚‹ã‹ã‚‚。ã“ã“ã§ã¯é©å½“ã«ã‹ã„ã¤ã¾ã‚“ã æ‰‹é †ã‚’æ›¸ã„ã¦ãŠã。一部時間ã®ã‹ã‹ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã‚‚ã‚ã‚‹ã‘ã©ã€åŸºæœ¬çš„ã«æ±ºã¾ã£ãŸè¨å®šæ›¸ãã ã‘ãªã®ã§æ™‚é–“ã¯ã‹ã‹ã‚Šã¾ã›ã‚“。（もã¡ã‚ã‚“ã©ã†ã„ã†æ„味ãªã®ã‹çŸ¥ã£ã¦ãŠãã«è¶Šã—ãŸã“ã¨ã¯ãªã„） SSLã®è©•ä¾¡è¨ˆæ¸¬ã«ã¤ã„㦠SSLサーãƒãƒ¼ã®ãƒ†ã‚¹ãƒˆã¯Qualys SSL Reportã§ç¢ºèªã—ã¾ã™ã€‚ Nginxデフォルトã®è¨å®šã§è¨ˆæ¸¬ã—ãŸã‚‰Cã ã£ãŸã€‚ SSLv3 を無効ã«ã™ã‚‹ SSLv3
ç´°ã‹ã™ãŽã¦ä¼ã‚らãªã„SSL/TLS
ãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã¯ã€2023å¹´10月1æ—¥ã«LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã«ãªã‚Šã¾ã—ãŸã€‚LINEãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã®æ–°ã—ã„ブãƒã‚°ã¯ã“ã¡ã‚‰ã§ã™ã€‚LINEヤフー Tech Blog 「細ã‹ã„ã¨è¨€ã†ã‚ˆã‚Šé•·ã„よã〠ã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€‚ATS ã®è„†å¼±æ€§ã‚’発見ã—ãŸå°æŸ´ã•ã‚“ã‚„ ATS ã« HTTP/2 ã®å®Ÿè£…ã‚’è¡Œã£ã¦ã„る大久ä¿ã•ã‚“ã¨åŒã˜ãƒãƒ¼ãƒ ã®ä¸€å¹´ç›®ã€åŒ¿å社員M ã•ã‚“ã‹ã‚‰ã„ã˜ã‚‰ã‚Œã¦ã„る新人ã§ã™ã€‚今回ã‚ã‚ŠãŒãŸã„事ã«ã€ã“ã†ã„ã£ãŸã™ã”ã„方々をå«ã‚モヒカン諸先輩方より「何ã‹æ›¸ã‹ãªã„ã®ï¼Ÿã€ã€Œã„ã¤æ›¸ãã®ï¼Ÿã€ã¨ã„ã†æ•°ã€…ã®ãƒ—レッシャーãŠè¨€è‘‰ã‚’ã„ãŸã ãã¾ã—ãŸã€‚ ã¨ã„ã†ã‚ã‘ã§ã€SSL/TLS ã® Session å†é–‹æ©Ÿèƒ½ã«é–¢ã—ã¦æ›¸ã„ã¦ã„ã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ SSL/TLS ã¯æ©Ÿå¯†æ€§ã€å®Œå…¨æ€§ãã—ã¦çœŸæ£æ€§ã«å¯¾ã—ã¦å®‰å…¨ãªé€šä¿¡ã‚’è¡Œã†ãŸã‚ã®ä»•çµ„ã¿ã§ã™ã€‚ã—ã‹ã—ã€ã“ã®ä»•çµ„ã¿ã¯æš—å·æŠ€è¡“を多用ã—特ã«æŽ¥ç¶šã«ãŠã„ã¦è¤‡é›‘ãªãƒ—ãƒãƒˆã‚³ãƒ«ã‚’用ã„ã€Client, Se
複数ã®Webサーãƒã§SSLセッションã‚ャッシュを共有ã—ã¦SSL処ç†ã‚’高速化(Apache + mod_ssl + mod_socache_memcache) - å…ƒRX-7ä¹—ã‚Šã®é©å½“ãªæ—¥ã€…
HTTPS(SSL利用)サイトãŒSEOçš„ã«å„ªé‡ã•ã‚Œã‚‹ãƒˆãƒ¬ãƒ³ãƒ‰ã§ã€ä¸–é–“çš„ã«ã‚‚HTTPS接続ã§ã‚µã‚¤ãƒˆé‹ç”¨ã™ã‚‹ã‚µãƒ¼ãƒ“スãŒå¢—ãˆã¦ãã¦ã„ã¾ã™ã€‚ ã“ã‚ŒãŒã€ãƒã‚¤ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚µã‚¤ãƒˆã«ãªã£ã¦ãã‚‹ã¨ã€ã“ã®ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã§SSL処ç†ã•ã›ã‚‹ã“ã¨ãŒè² è·çš„ã«ã‚‚ãªã‹ãªã‹è¾›ã„ã®ã§ã™ã€‚ ã§ã€Apache 2.3以é™ã§ã¯ã€Shared Object Cache Providerã¨ã—ã¦ã€memcachedãŒé¸æŠžã§ãるよã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ ã“ã®ä»•çµ„ã¿ã‚’利用ã—ã¦ã€Apacheã¨memcachedを並ã¹ã‚‹ã“ã¨ã§ã€å„サーãƒã§ãƒ¦ãƒ¼ã‚¶ã®SSL Session Cacheを共有ã—ãªãŒã‚‰HTTPSãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’è² è·åˆ†æ•£ã§ãる構æˆã‚’作ã£ã¦ã¿ã¾ã—ãŸã€‚ Webサーãƒã§SSLオフãƒãƒ¼ãƒ‰ 常時SSLを利用ã—ãŸWebサイトをé‹ç”¨ã™ã‚‹ãŸã‚ã«ã€SSLアクセラレータã¨ã„ã£ãŸã‚¢ãƒ—ライアンス製å“ã ã¨ã‹ã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã ã¨Apacheã‚„Nginxã®SSLモジュールを使ã†
サーãƒã®SSL CA(èªè¨¼å±€)証明書ãŒå¤ãã¦curl ãŒã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ä»¶ - ã†ã¾ã„ã¼ã†ã¶ã‚ã
å¤ã„サーãƒã«rvmã‚’github ã‹ã‚‰å–ã£ã¦ã“よã†ã¨ã—ãŸã‚‰ã‚¨ãƒ©ãƒ¼ã«ãªã£ãŸã‚ˆã€‚ æ–°ã—ã„サームhttps://raw.github.com ã¸ã®Redirectã‚‚å•é¡Œãªãアクセスã§ãã¦ã‚‹ã€‚ $ curl -L -I get.rvm.io HTTP/1.1 301 Moved Permanently Server: nginx/1.0.14 Date: Thu, 21 Jun 2012 01:22:39 GMT Content-Type: text/html Content-Length: 185 Connection: keep-alive Location: https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer HTTP/1.1 200 OK Server: nginx/1.0.13 Date: Th
SSL/TLSライブラリã®æ£ã—ã„使ã„方（もã—ãã¯ã€ã‚³ãƒ¢ãƒ³ãƒãƒ¼ãƒ ã®æ¤œè¨¼ã«ã¤ã„ã¦ï¼‰
スマホアプリã®å¸‚å ´æ‹¡å¤§ã«ä¼´ã„ã€ç›´æŽ¥SSL/TLSライブラリを使用ã™ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ を書ã機会も増ãˆã¦ãã¦ã„る今日ã“ã®é ƒã‹ã¨æ€ã„ã¾ã™ã€‚ SSL/TLSライブラリを使ã†éš›ã«ã¯ã€æŽ¥ç¶šç¢ºç«‹æ™‚ã«ã‚µãƒ¼ãƒã®èªè¨¼ã‚’æ£ã—ãè¡Œã†å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚具体的ã«ã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ—ãƒã‚°ãƒ©ãƒ ã§ä»¥ä¸‹ã®ï¼’種類ã®æ¤œè¨¼ã‚’è¡Œã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ SSL/TLSライブラリãŒã‚µãƒ¼ãƒã®è¨¼æ˜Žæ›¸ã®æ¤œè¨¼ã«æˆåŠŸã—ãŸã“㨠サーãƒã®è¨¼æ˜Žæ›¸ã«å«ã¾ã‚Œã‚‹ã‚³ãƒ¢ãƒ³ãƒãƒ¼ãƒ 注1ãŒæŽ¥ç¶šã—よã†ã¨ã—ãŸã‚µãƒ¼ãƒã¨åŒä¸€ã§ã‚ã‚‹ã“㨠å‰è€…ã«ã¤ã„ã¦ã¯ã€OpenSSLã®å ´åˆã¯SSL_CTX_set_verifyã®å¼•æ•°ã«SSL_VERIFY_PEERを指定ã™ã‚‹ãªã©ã—ã¦ã€ãƒ©ã‚¤ãƒ–ラリå´ã§å‡¦ç†ã‚’è¡Œã‚ã›ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ï¼ˆè¨¼æ˜Žæ›¸ã®æ¤œè¨¼ã«å¤±æ•—ã—ãŸå ´åˆã¯SSL_connectãŒã‚¨ãƒ©ãƒ¼ã‚’è¿”ã—ã¾ã™ï¼‰ã€‚ 一方ã€å¾Œè€…ã«ã¤ã„ã¦ã¯SSL/TLSライブラリã«ã‚ˆã£ã¦å·®ãŒã‚ã‚Šã€æ¤œè¨¼æ©Ÿèƒ½ã‚’有効ã«ã™ã‚‹ãŸã‚ã«ç‰¹åˆ¥ãªå‘¼å‡ºãŒå¿…è¦ã ã£
Speeding up TLS: enabling session reuse
Session reuse is one of the most important mechanisms to improve TLS performance: by submitting an appropriate blob to the server, a client can trigger an abbreviated handshake, improving latency and computation time. There exist two distinct ways to achieve session reuse: session identifiers as described in RFC 5246 and session tickets as depicted in RFC 5077. Update (2018-08) While the content o
HTTP/2.0ã®ALPN利用ã«ä¼´ã†SSLè² è·åˆ†æ•£è£…ç½®ã®ä¸å…·åˆã«ã”注æ„下ã•ã„ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã«ã€ ãŸã 今IETF-88@ãƒãƒ³ã‚¯ãƒ¼ãƒãƒ¼ã®é–‹å‚¬ãŒçœŸã£ãŸã ä¸ã§ã™ã€‚スノーデン事件ã®ä½™æ³¢ã‚‚ã‚ã‚Šã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“（特ã«ã‚»ã‚ュリティ関連）ã®è°è«–ã¯ç†±ããªã£ã¦ã„ã¾ã™ã€‚ ã¡ã‚‡ã†ã©ä»Šæœæœªæ˜Žï¼ˆãƒãƒ³ã‚¯ãƒãƒ¼ã§ã¯11/5æœï¼‰ã« HTTP/2.0ã®æ¨™æº–化を進ã‚ã‚‹ httpbis ワーã‚ンググループã¨ã‚»ã‚ュリティエリアã®åˆåŒã‚»ãƒƒã‚·ãƒ§ãƒ³ãŒé–‹å‚¬ã•ã‚Œã¾ã—ãŸã€‚åˆåŒã‚»ãƒƒã‚·ãƒ§ãƒ³ã§ã¯ã€ãƒ˜ãƒƒãƒ€åœ§ç¸®æŠ€è¡“(HPACK)ã®ã‚»ã‚ュリティやã€HTTP接続(HTTPSã§ã¯ãªã„）ã§é€šä¿¡ã®æš—å·åŒ–ã‚’è¡Œã£ãŸã‚‰ã©ã†ã‹ã€ã¨ã„ã£ãŸèˆˆå‘³æ·±ã„è°è«–ãŒè¡Œã‚ã‚Œã¾ã—ãŸã€‚ã“ã®ã†ã¡å°†æ¥HTTP/2.0ã®å±•é–‹ã«é‡è¦ãª ALPN(Application Layer Protocol Negotiation) ã¯ã€ã“ã®ãƒŸãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã§æœ€çµ‚çš„ãªä»•æ§˜ã‚’確定ã•ã›ã‚‹æ®µéšŽã§ã®è°è«–ã§ã—ãŸã€‚è°è«–ã®ä¸ã§ã€ALPNã®å°Žå…¥ã«ã‚ˆã£ã¦ãƒ–ラウザã‹ã‚‰æ—¢å˜ã®å®Ÿã‚µãƒ¼ãƒ“スã¸ã®æŽ¥ç¶šã«(å°‘ãªã‹ã‚‰ãš)å½±
Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?
In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not doing a PCI compliant site, so by using only the above two ciphers, is it enough for most purpose? (by enough I mean wide range of browser support) [1] https://www.ssllabs.com/ssltest/
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
動的証明書èªã¿è¾¼ã¿ ngx_mrubyç·¨ #hoscon / GMO HosCon 2016
httpsã ã‹ã‚‰ã¨ã„ã†ã ã‘ã§å®‰å…¨ï¼Ÿèª¿ã¹ãŸã‚‰æ€–ããªã£ã¦ããŸSSLã®è©±!？ - Qiita
SSL Server Test (Powered by Qualys SSL Labs)
Invalid SSL certificate when pushing to Git server
{{#tags}}- {{label}}
{{/tags}}