Difference between revisions of "SSL Best Practices"

From OWASP
Jump to: navigation, search
 
Line 1: Line 1:
**What is SSL
+
==Introduction and Contents:==
**How SSL is implemented in J2EE
+
 
**HTTPS best practices in general
+
*What is SSL
**HTTPS best practices in J2EE
+
*How SSL is implemented in J2EE
**Examples with Tomcat
+
*HTTPS best practices in general
**Examples with JBoss.
+
*HTTPS best practices in J2EE
 +
*Examples with Tomcat
 +
*Examples with JBoss.
 +
 
 +
==What is SSL:==
 +
 
 +
SSL is the abreviation of Secured Socket Layer. It is a network level protocol enabling to settle a secured communication between two hosts. The origin host is viewed as an SSL client and the destination host as an SSL server.
 +
 
 +
SSL has also been normalised as the TLS (Transport Layer Security) protocol.
 +
 
 +
'''SSL is used on top of a transport level protocol''' like HTTP or FTP in order to secure them.
 +
 
 +
SSL enables :
 +
* authentication of the destination host for the origin host or mutual authentication of both the origin and the destination hosts
 +
* data confidentiality through encryption
 +
* data integrity checking through hashing.
 +
 
 +
SSL relies on two types of encryptions :
 +
* public key encryption in the initiation phase, where authentication takes place
 +
* secret key encryption when a session has been established and data is sent between two peers which trust each other.
 +
 
 +
'''SSL only secures the communication between two endpoints''' : in the origin and destination points, data is in clear text, unless it is encrypted by another means, at the application level.

Revision as of 11:12, 13 October 2006

Introduction and Contents:

  • What is SSL
  • How SSL is implemented in J2EE
  • HTTPS best practices in general
  • HTTPS best practices in J2EE
  • Examples with Tomcat
  • Examples with JBoss.

What is SSL:

SSL is the abreviation of Secured Socket Layer. It is a network level protocol enabling to settle a secured communication between two hosts. The origin host is viewed as an SSL client and the destination host as an SSL server.

SSL has also been normalised as the TLS (Transport Layer Security) protocol.

SSL is used on top of a transport level protocol like HTTP or FTP in order to secure them.

SSL enables :

  • authentication of the destination host for the origin host or mutual authentication of both the origin and the destination hosts
  • data confidentiality through encryption
  • data integrity checking through hashing.

SSL relies on two types of encryptions :

  • public key encryption in the initiation phase, where authentication takes place
  • secret key encryption when a session has been established and data is sent between two peers which trust each other.

SSL only secures the communication between two endpoints : in the origin and destination points, data is in clear text, unless it is encrypted by another means, at the application level.