Chapter 4. SSL and TLS
Like many other Internet protocols created before it, HTTP was
designed under the assumption that data transmission would be secure.
This is a perfectly valid assumption; it makes sense to put a
separate communication layer in place to worry about issues such as
confidentiality and data integrity. Unfortunately, a solution to
secure data transmission was not offered at the same time as HTTP. It
arrived years later, initially as a proprietary protocol.
By today's standards, the Internet was not a very
secure place in the early days. It took us many years to put
mechanisms in place for secure communication. Even today, millions of
users are using insecure, plaintext communication protocols to
transmit valuable, private, and confidential information.
Not taking steps to secure
HTTP communication can lead to the
following weaknesses:
Data transmission can be intercepted and recorded with relative ease. For applications that require users to authenticate themselves,
usernames and passwords are trivial to collect as they flow over the
wire. User sessions can be hijacked, and attackers can assume
users' identities.
Since these are serious problems, the only cases where additional
security measures are not required are with a web site where all
areas are open to the public or with a web site that does not contain
any information worth protecting. Some cases require protection:
When a web site needs to collect sensitive information from its users
(e.g., credit card numbers), it must ensure the communication cannot
be intercepted and the information hijacked. The communication between internal web applications and intranets is
easy to intercept since many users share common network
infrastructure (for example, the local area network). Encryption
(described later in the chapter) is the only way to ensure
confidentiality. Mission-critical web applications require a maximum level of
security, making encryption a mandatory requirement.
To secure HTTP, the Secure Sockets Layer
(SSL) protocol is used. This chapter begins by covering cryptography
from a practical point of view. You only need to understand the basic
principles. We do not need to go into mathematical details and
discuss differences between algorithms for most real-life
requirements. After documenting various types of encryption, this
chapter will introduce SSL and describe how to use the OpenSSL
libraries and the mod_ssl Apache module. Adding
SSL capabilities to the web server is easy, but getting the
certificate infrastructure right requires more work. The end of the
chapter discusses the impact of SSL on performance and explains how
to determine if SSL will represent a bottleneck.
|
