SSL Web Hosting

Beginning Guide to Install SSL

noreply@blogger.com (neko19) — Sun, 08 Aug 2010 23:50:00 +0000

Who needs an SSL certificate?

If you will accept or secure information processing from your website, such as credit card payments online, or other confidential information, you will need an SSL certificate. SSL means Secure Socket Layer. Data shared between users' computers and server are encrypted for security.

There are different kinds of SSL certificates. The price varies very little money, hundreds of dollars per year. Most of your sensitive information, most probably have to spend on an SSL certificate.

Important: Most applications can obtain licenses at a cost less than $ 100 per year. If you accept credit card payments directly from the server, you should contact your bank or credit card payment gateway, to determine their needs. Some are very strict.

Server Requirements

Your server must have the capacity for secure connections. Probably nothing to fear, because most do.

Dedicated IP Address

You will need a special (unique) IP address. If you're on shared hosting plan, you should ask your hosting company for a dedicated IP address. SSL certificates can not be installed on a shared IP address unless the certificate is shared. This is not a common scenario at all.
Some hosting companies to move to a dedicated IP address for free. Other charges a fee (usually) small a month for a dedicated IP address.

What you need to buy the certificate

Have to generate a signing request (CSR). If you have never had an SSL certificate on your site, you may have to generate a "key" first. Both are made from the control panel of your server.

Purchase and installation of SSL certificates

   1. Log in to your server.
   2. Generate the key if there is one already. For the purposes of SEO, you want to be consistent. The industry standard is to include the "www." with the domain name.
   3. Once the key is generated, it is necessary to generate the CSR. Be sure to select the correct key if you have more than one option (the one with the "www." The most likely). Enter the information that the server application (country, city, state, etc) and the server display a page with CSR, new on it, or by email to the CSR for you. Keep this page up, or copy and paste the CSR into a text document such as Notepad (word processing like Microsoft Word can spoil) A are considered as CSR: ----- BEGIN CERTIFICATE REQUEST --- - *** There will be several lines of random looking characters here. *** ----- END CERTIFICATE REQUEST ----- Be sure to include the scripts before and after application "in early certificate" and "Certificate Request" at the end of the copy of the CSR
   4. When you buy an SSL certificate, there will be a way to configure the certificate. They are slightly different, but the instructions should be available from the manufacturer. You have to paste the CSR in a field, and contact information in the highest number in three places. You must enter the certificate holder, name, address, email, etc. For most suppliers, even for the technical contact and billing contact. (All can be the same person)
   5. Once you submit the CSR and contact information, you must select an email address for approval. The certificate of authority shall submit an email to the address you choose to approve the transaction. The email address for the signatory must be authorized for the domain or server. An email that is acceptable is common admin@mydomain.tld (where "mydomain.tld" is the actual domain that the certificate is installed.) There are many others such as "webmaster" or "ssladmin" that work, so You may need to check.
   6. Once the agent approves the certificate, the applicant will receive an email containing the certificate (and possibly a 'CA package). The certificate will be very similar to CSR, but it will be bigger. Be sure to include all the characters of "Begin Certificate" through (including) the certificate after the dashes. The certificate will look like: ----- BEGIN CERTIFICATE ----- *** There will be several lines of random looking characters here. *** ----- END CERTIFICATE -----
   7. There are generally two ways to install the certificate. Some servers ask you to paste the certificate (and CA beams where appropriate) in a field on the server. Some will allow you to download the certificate from a text file or e-mail on your computer. The server certificate installed.

If you did everything correctly, you must install without problems. If you receive errors or warnings, you must contact the server administrator for assistance.

Web hosting term SSL Certificate (SSL)

noreply@blogger.com (neko19) — Fri, 31 Jul 2009 06:50:00 +0000

Transport Layer Aegis (TLS) and its predecessor, Defended Sockets Layer (SSL), are cryptographic protocols that accommodate defended communications on the Internet for such things as web browsing, e-mail, Internet faxing, burning messaging and added abstracts transfers. There are slight differences amid SSL and TLS, but the agreement charcoal about the same. The appellation "TLS" as acclimated actuality applies to both protocols unless antiseptic by context.

Description

The TLS agreement allows applications to acquaint beyond a arrangement in a way advised to anticipate eavesdropping, tampering, and bulletin forgery. TLS provides endpoint affidavit and communications aloofness over the Internet appliance cryptography. Typically, alone the server is accurate (i.e., its character is ensured) while the applicant charcoal unauthenticated; this agency that the end user (whether an alone or an application, such as a Web browser) can be abiding with whom they are communicating. The abutting akin of security-in which both ends of the "conversation" are abiding with whom they are communicating-is accepted as alternate authentication. Alternate affidavit requires accessible key basement (PKI) deployment to audience unless TLS-PSK or TLS-SRP are used, which accommodate able alternate affidavit after defective to arrange a PKI.

TLS involves three basal phases:

1. Peer agreement for algorithm support

2. Accessible key barter and certificate-based authentication

3. Symmetric blank encryption

During the aboriginal phase, the applicant and server accommodate blank suites, which amalgamate one blank from anniversary of the following:

* Public-key cryptography: RSA, Diffie-Hellman, DSA

* Symmetric ciphers: RC2, RC4, IDEA, DES, Triple DES, AES or Camellia

* Cryptographic assortment function: MD2, MD4, MD5 or SHA

How it works

A TLS applicant and server accommodate a stateful affiliation by appliance a handshaking procedure. During this handshake, the applicant and server accede on assorted ambit acclimated to authorize the connection's security.

* The handshake begins aback a applicant connects to a TLS-enabled server requesting a defended connection, and presents a account of ciphers and assortment functions.

* From this list, the server picks the arch blank and assortment action that it additionally supports and notifies the applicant of the decision.

* The server sends aback its identification in the anatomy of a agenda certificate. The affidavit will usually accommodate the server name, the trusted affidavit ascendancy (CA), and the server's accessible encryption key.

The applicant may acquaintance the server of the trusted CA and affirm that the affidavit is accurate afore proceeding.

* In adjustment to accomplish the affair keys acclimated for the defended connection, the applicant encrypts a accidental cardinal with the server's accessible key, and sends the aftereffect to the server. Alone the server can break it (with its clandestine key): this is the one actuality that makes the keys hidden from third parties, back alone the server and the applicant accept admission to this data.

* Both parties accomplish key absolute for encryption and decryption.

This concludes the handshake and begins the anchored connection, which is encrypted and decrypted with the key absolute until the affiliation closes.

If any one of the aloft accomplish fails, the TLS handshake fails, and the affiliation is not created.

TLS Handshake in Detail

The TLS agreement exchanges annal that abbreviate the abstracts to be exchanged. Anniversary almanac can be compressed, padded, added with a bulletin affidavit blank (MAC), or encrypted, all depending on the accompaniment of the connection. Anniversary almanac has a agreeable blazon acreage that specifies the record, a breadth field, and a TLS adaptation field.

When the affiliation starts, the almanac encapsulates addition protocol, the handshake protocol, which has agreeable blazon 22.

A simple affiliation archetype follows:

* A Applicant sends a ClientHello bulletin allegorical the accomplished TLS agreement adaptation it supports, a accidental number, a account of appropriate blank suites and compression methods.

* The Server responds with a ServerHello, absolute the alleged agreement version, a accidental number, blank suite, and compression adjustment from the choices offered by the client.

* The Server sends its Affidavit (depending on the alleged blank suite, this may be bare by the Server).

: These certificates are currently X.509, but there is additionally a abstract allegorical the use of OpenPGP based certificates.

* The server may appeal a affidavit from the client, so that the affiliation can be mutually authenticated, appliance a CertificateRequest.

* The Server sends a ServerHelloDone message, advertence it is done with handshake negotiation.

* The Applicant responds with a ClientKeyExchange message, which may accommodate a PreMasterSecret, accessible key, or nothing. (Again, this depends on the alleged cipher.)

* The Applicant and Server again use the accidental numbers and PreMasterSecret to compute a accepted secret, alleged the "master secret". All added key abstracts is acquired from this adept abstruse (and the client- and server-generated accidental values), which is anesthetized through a anxiously advised "pseudorandom function".

* The Applicant now sends a ChangeCipherSpec message, about cogent the Server, "Everything I acquaint you from now on will be encrypted." Note that the ChangeCipherSpec is itself a record-level protocol, and has blazon 20, and not 22.

* Finally, the Applicant sends an encrypted Finished message, absolute a assortment and MAC over the antecedent handshake messages.

* The Server will attack to break the Client's Finished message, and verify the assortment and MAC. If the decryption or analysis fails, the handshake is advised to accept bootless and the affiliation should be burst down.

* Finally, the Server sends a ChangeCipherSpec and its encrypted Finished message, and the Applicant performs the aforementioned decryption and verification.

* At this point, the "handshake" is complete and the Appliance agreement is enabled, with agreeable blazon of 23. Appliance letters exchanged amid Applicant and Server will be encrypted.

Security

TLS/SSL accepts an array of aegis measures:

* The applicant may use the CA's accessible key to validate the CA's agenda signature on the server certificate. If the agenda signature can be verified, the applicant accepts the server affidavit as a accurate affidavit issued by a trusted CA.

* The applicant verifies that the arising Affidavit Ascendancy (CA) is on its account of trusted CAs.

* The applicant checks the server's affidavit ascendancy period. The affidavit action stops if the accepted date and time abatement alfresco of the ascendancy period.

* To assure adjoin Man-in-the-Middle attacks, the applicant compares the absolute DNS name of the server to the DNS name on the certificate. Browser-dependent, not authentic by TLS.

* Aegis adjoin a decline of the agreement to a antecedent (less secure) adaptation or a weaker blank suite.

* Numbering all the Appliance annal with an arrangement number, and appliance this arrangement cardinal in the MACs.

* Appliance a bulletin abstract added with a key (so alone a key-holder can analysis the MAC). This is authentic in RFC 2104. TLS only.

* The bulletin that ends the handshake ("Finished") sends a assortment of all the exchanged handshake letters apparent by both parties.

* The pseudorandom action splits the ascribe abstracts in bisected and processes anniversary one with a altered hashing algorithm (MD5 and SHA-1), again XORs them together. This provides aegis if one of these algorithms is begin to be vulnerable. TLS only.

* SSL v3 bigger aloft SSL v2 by abacus SHA-1 based ciphers, and abutment for affidavit authentication. Additional improvements in SSL v3 accommodate bigger handshake agreement breeze and added attrition to man-in-the-middle attacks.

Applications

TLS runs on layers below appliance protocols such as HTTP, FTP, SMTP, NNTP, and XMPP and aloft a reliable carriage protocol, TCP for example. While it can add aegis to any agreement that uses reliable access (such as TCP), it is best frequently acclimated with HTTP to anatomy HTTPS. HTTPS is acclimated to defended World Wide Web pages for applications such as cyberbanking business and asset management. SMTP is additionally a breadth in which TLS has been growing and is authentic in RFC 3207. These applications use accessible key certificates to verify the character of endpoints.

An accretion cardinal of applicant and server articles abutment TLS natively, but abounding still abridgement support. As an alternative, users may ambition to use standalone TLS articles like Stunnel. Wrappers such as Stunnel await on actuality able to access a TLS affiliation immediately, by artlessly abutting to a abstracted anchorage aloof for the purpose. For example, by absence the TCP anchorage for HTTPS is 443, to analyze it from HTTP on anchorage 80.

TLS can additionally be acclimated to adit an absolute arrangement assemblage to actualize a VPN, as is the case with OpenVPN. Abounding vendors now ally TLS's encryption and affidavit capabilities with authorization. There has additionally been abundant development back the astern 1990s in creating applicant technology alfresco of the browser to accredit abutment for client/server applications. Aback compared adjoin acceptable IPsec VPN technologies, TLS has some inherent advantages in firewall and NAT bridge that accomplish it easier to administrate for ample remote-access populations.

TLS is additionally added actuality acclimated as the accepted adjustment for attention SIP appliance signaling. TLS can be acclimated to accommodate affidavit and encryption of the SIP signalling associated with VOIP (Voice over IP) and added SIP-based applications.

History and development

The SSL agreement was originally developed by Netscape. Adaptation 1.0 was never about released; adaptation 2.0 was arise in 1994 but "contained a cardinal of aegis flaws which ultimately led to the architecture of SSL adaptation 3.0", which was arise in 1996 (Rescorla 2001). This after served as the base for TLS adaptation 1.0, an IETF accepted agreement aboriginal authentic in RFC 2246 in January 1999. Visa, MasterCard, American Express and abounding arch banking institutions accept accustomed SSL for business over the Internet.

SSL operates in modular fashion. It is adaptable by design, with abutment for advanced and astern affinity and agreement amid peers.

Early abbreviate keys

Some aboriginal implementations of SSL acclimated 40-bit symmetric keys because of US government restrictions on the consign of cryptographic technology. The US government absolutely imposed a 40-bit keyspace, which was baby abundant to be burst by brute-force chase by law administration agencies adulatory to apprehend the encrypted traffic, while still presenting obstacles to less-well-funded attackers. A agnate limitation activated to Lotus Notes in consign versions. After several years of accessible controversy, a alternation of lawsuits, and closing US government acceptance of cryptographic articles with best key sizes produced alfresco the US, the authorities airy some aspects of the consign restrictions. The 40-bit key admeasurements limitation has mostly gone away, and avant-garde implementations use 128-bit (or longer) keys for symmetric key ciphers.

Standards

The aboriginal analogue of TLS appeared in:

* RFC 2246: "The TLS Agreement Adaptation 1.0".

The accepted accustomed adaptation is 1.1, which is authentic in

* RFC 4346: "The Carriage Layer Aegis (TLS) Agreement Adaptation 1.1".

The abutting adaptation is proposed:

* RFC Abstract 4346 - The TLS Protocol, Adaptation 1.2 (published July 2007, expires January 2008)

Other RFC after continued TLS, including:

* RFC 2595: "Using TLS with IMAP, POP3 and ACAP". Specifies an addendum to the IMAP, POP3 and ACAP casework that acquiesce the server and applicant to use transport-layer aegis to accommodate private, accurate advice over the Internet.

* RFC 2712: "Addition of Kerberos Blank Suites to Carriage Layer Aegis (TLS)". The 40-bit cipher suites authentic in this announcement arise alone for the purpose of documenting the actuality that those cipher suite codes accept already been assigned.

* RFC 2817: "Upgrading to TLS within HTTP/1.1", explains how to use the Upgrade apparatus in HTTP/1.1 to admit Carriage Layer Aegis (TLS) over an absolute TCP connection. This allows apart and anchored HTTP cartage to allotment the aforementioned able-bodied accepted anchorage (in this case, http: at 80 rather than https: at 443).

* RFC 2818: "HTTP Over TLS", distinguishes anchored cartage from afraid cartage by the use of a altered 'server port'.

* RFC 3207: "SMTP Account Addendum for Defended SMTP over Carriage Layer Security". Specifies an addendum to the SMTP account that allows an SMTP server and applicant to use transport-layer aegis to accommodate private, accurate advice over the Internet.

* RFC 3268: "AES Cipher suites for TLS". Adds Advanced Encryption Accepted (AES) ciphersuites to the ahead absolute symmetric ciphers.

* RFC 3546: "Transport Layer Aegis (TLS) Extensions", adds a apparatus for negotiating agreement extensions during affair initialisation and defines some extensions.

* RFC 4132: "Addition of Camellia Blank Suites to Carriage Layer Aegis (TLS)".

* RFC 4162: "Addition of SEED Blank Suites to Carriage Layer Aegis (TLS)".

* RFC 4279: "Pre-Shared Key Cipher suites for Carriage Layer Aegis (TLS)", adds three sets of new cipher suites for the TLS agreement to abutment affidavit based on pre-shared keys.

* RFC 4347: "Datagram Carriage Layer Security" specifies a TLS alternative that works over datagram protocols (such as UDP).

* RFC 4366: "Transport Layer Aegis (TLS) Extensions" describes both a set of specific extensions, and a all-encompassing addendum mechanism.

* RFC 4492: "Elliptic Curve Cryptography (ECC) Blank Suites for Carriage Layer Aegis (TLS)".

Implementation

Programmers may use the OpenSSL, NSS, or GnuTLS libraries for SSL/TLS functionality. Microsoft Windows includes an accomplishing of SSL and TLS as allotment of its Defended Channel package. Delphi programmers may use a library alleged Indy.

TLS 1.1

As acclaimed above, TLS 1.1 is the accepted accustomed adaptation of the TLS protocol. TLS 1.1 clarifies some ambiguities and adds a cardinal of recommendations, but charcoal actual agnate to TLS 1.0. An abounding account of differences is provided in RFC 4346 (Section 1.1).

Certificate providers

A 2005 Netcraft analysis bent that VeriSign and its acquisitions such as Thawte accept a 53% allotment of the affidavit ascendancy market, followed by GeoTrust (25%), Comodo (12%), GoDaddy (4%) and Entrust (2%). (GeoTrust has back been acquired by VeriSign.)

A added contempo bazaar allotment address from Aegis Space as of April 2007 bent that VeriSign and its acquisitions (including GeoTrust) accept a 59.6% allotment of the affidavit ascendancy market, followed by Comodo (8.3%), GoDaddy (5.3%), DigiCert (2.1%), Entrust (1.3%) and Arrangement Solutions (1.1%).

CAcert.org is a community-driven affidavit ascendancy that issues chargeless accessible key certificates.

Force SSL/https using .htaccess and mod_rewrite (SSL Web Hosting)

noreply@blogger.com (neko19) — Fri, 31 Jul 2009 02:43:00 +0000

Sometimes you may charge to accomplish abiding that the user is browsing your armpit over securte connection. An accessible to way to consistently alter the user to defended affiliation (https://) can be able with a .htaccess book absolute the afterward lines:

RewriteEngine On

RewriteCond %{SERVER_PORT} 80

RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

Please, note that the .htaccess should be amid in the web armpit capital folder.

In case you ambition to force HTTPS for a accurate binder you can use:

RewriteEngine On

RewriteCond %{SERVER_PORT} 80

RewriteCond %{REQUEST_URI} somefolder

RewriteRule ^(.*)$ https://www.domain.com/somefolder/$1 [R,L]

The .htaccess book should be placed in the binder area you charge to force HTTPS.

Web Hosting Basics: Extended Validation SSL Certificates (SSL web hosting)

noreply@blogger.com (neko19) — Fri, 31 Jul 2009 01:38:00 +0000

In 2005, an accumulation of arch acceptance authorities (CAs) and Internet browsers came calm to authorize a added accurate and harmonized access to online SSL security.

Known as the CA/Browser Forum, the accumulation absitively a connected Secure Socket Layer (SSL) adjustment was needed, to prove a website’s actuality above all browsers, for all CAs and for all Web users. In January 2007, new Extended Validation (EV) SSL certificates were at aftermost appears worldwide, and is accepted to abundantly enhance ecommerce and addition the aplomb of online shoppers everywhere.

Wayne Thayer, Vice President of Development for GoDaddy – an apple arch SSL Web hosting provider, area agent and above affiliate of the CA/Browser Appointment – told TopHosts that the aim of EV SSL is to accommodate an abundant needed, constant way of ensuring angary online.

“There were a cardinal of above players that acquainted we bare to actualize some array of accepted we could accompany to the marketplace,” Thayer said. “An affidavit that meant the aforementioned affair no amount area you bought it from.”

Up until the barrage of EV SSL, Thayer explained abounding differing levels of SSL certificates could be obtained, but none absolutely activity above WebTrust – a allowance awarded to sites that attach to assertive business standards. Abounding altered types of SSLs, like GoDaddy’s Turbo SSL and High-Assurance SSL, for example, accommodate abundant aegis and online assurance, but may not accept by the aforementioned rules and regulations of added CAs and Web hosting providers. There is artlessly no accord amid them, and they don’t abode growing apropos phishing, an anatomy of Internet artifice that aims to abduct admired advice such as acclaim cards, SSNs, IDs and passwords, through affected websites.

With EV SSLs, all CAs charge attach to the aforementioned aegis standards back processing affidavit requests, while visitors to EV SSL-secured sites can assurance that the online alignment has undergone the aforementioned accepted affidavit process.

“The EV vetting action creates an absolute able tie amid the alignment that is called in the affidavit and the absolute apple organization,” Thayer said. “… EV SSL has a cardinal of added accomplish that accomplish it abundant added difficult for fraudsters to accomplish phishing and pretend they’re article they’re not.”

The CA/Browser appointment outlines a new EV SSL vetting process, which validates elements such as, the acknowledged actuality of the site, the acknowledged name of the entity, a allotment number, appropriate to use the area name, forth with added acknowledged indications. To administer for an EV SSL, the business charge present a letter from an advocate or an accountant. The action verifies the organization’s identity, the authority of the appeal and the all-embracing angary of the business.

Unlike the accepted padlock figure adjustment acclimated for all added SSL certificates, browsers with EV abutment will affectation a blooming abode bar and a appropriate label, which names the website buyer and the CA that issued their certificate. This beheld apparatus is abnormally advantageous for domains advised to be a high-risk ambition of phishing and added artifice schemes. Banking sites, bargain sites, retailers and added banking casework can bigger acquaint their angary to users, acceptance visitors to affirm that any online advice they advance is safe and adequate by EV.

Currently, alone Internet Explorer 7 and Opera 8 browsers are EV-ready and abutment the new beheld indicators. Mozilla and Safari are accepted to be committed to acknowledging the abstraction of EV, with Firefox accepted to apparatus it in their version-3 release.