iii
Table of Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
Feedback vi
About Bulletproof SSL/TLS and PKI vi
About the Author vi
1. OpenSSL Cookbook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Getting Started 2
Determine OpenSSL Version and Configuration 2
Building OpenSSL 3
Examine Available Commands 4
Building a Trust Store 5
Key and Certificate Management 7
Key Generation 7
Creating Certificate Signing Requests 11
Creating CSRs from Existing Certificates 13
Unattended CSR Generation 13
Signing Your Own Certificates 13
Creating Certificates Valid for Multiple Hostnames 14
Examining Certificates 15
Key and Certificate Conversion 18
Configuration 20
Cipher Suite Selection 21
Performance 31
A. SSL/TLS Deployment Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Introduction 35
1. Private Key and Certificate 36
1.1. Use 2048-bit Private Keys 36
1.2. Protect Private Keys 36
1.3. Ensure Sufficient Hostname Coverage 36
1.4. Obtain Certificates from a Reliable CA 37
Personal copy of Stanley Laurel <neolinux33@gmail.com>
