SSL/TLS Deep Dive

This course is designed to provide a very thorough understanding of Transport Layer Security and Secure Sockets Layer (TLS and SSL) – the protocols which are used to secure the vast majority of the Internet. This is meant to turn students with some minor exposure to SSL/TLS into SSL/TLS Experts and Subject Matter Experts (SMEs). This is a must have course if you work with SSL/TLS certificates on a day to day basis!

Testimonials

Target Audience

Anyone who wants a deep understanding of how those protocols work and how they are used to secure communication across the Internet.

Pre-requisites

Each student will need access to a Linux terminal with Openssl installed (typically installed by default). The terminal can be a local virtual machine, or a linux cloud server.

The labs make use of certain Linux commands. Linux mastery is not required, but some exposure to the following commands is helpful: cd mkdir cat echo wget tail head grep

Syllabus

The course starts with an overview of SSL, which leads into a discussion of the Cryptography necessary to understand how TLS/SSL provides security to Internet communication, including a real example of the math behind RSA Key Generation, Encryption, and Signing, and the math behind the Diffie-Hellman protocol.

The class is then introduced to the whole SSL Process, from establishing a Public and Private Key pair to getting a signed Certificate from a Certificate Authority. Following that, we take a closer look at the contents of a Certificate, a Private Key, and a Certificate Signing request. The students then complete a collaborative lab where they set up their own Certificate Authority.

Afterwards, the course takes a close look at exactly how a Client validates a Server’s Certificate – the heart of Public Key Infrastructure. The course then discusses the concept of Certificate Chains: why they are important and how they work. Then we take a quick look at the different types of Certificates available (DV, OV, EV), before continuing with an explanation of the two primary means of revoking a compromised certificate.

Lastly, the course ties everything together with a comprehensive look at what happens in the first few milliseconds when browsing any HTTPS website… the SSL Handshake. Each message in the SSL Handshake and their contents are illustrated and explained. The analysis concludes with an examination of the different variations of the SSL Handshake which allows for different features, extensions, and levels of security.

Finally, the students complete two additional labs. The first is designed to make them experts at determining complete, proper certificate chains. And the second one is a manual look at the Certificate Revocation process: how it works and its effectiveness.

By the end of course, the student will be able to:

• Explain the overarching process of securing a website using HTTPS
• Understand the role of the Client and Server in an SSL Handshake
• Understand the role of the Certificate Authority and intermediate CAs
• Discuss the cryptography involved in SSL and how it is used to provide secured communication
• Describe the contents of an X509 Certificate, RSA Private Key, and Certificate Signing Request (CSR)
• Explain and Convert Certificates and Keys between the three major versions (PEM/DER/PFX)
• Illustrate what a Client checks to validate a Server’s Certificate
• Understand the purpose and functional operation of a Certificate Chain
• Describe the various messages in an SSL Handshake
• Know, Understand, and be able to define and explain the following concepts and terms:
  • Certificate Chains, Certificate Revocation List (CRL), Certificate Signing Request (CSR), Change Cipher Spec, Cipher Suites, Common Name, Distinguished Named, Domain Validation (DV), End Entity Certificate, Ephemeral Key Exchanges, Export grade ciphers, Extended Validation (EV) Certificate, Handshake Messages, Intermediate Certificates, Issuer, Message Signing, OCSP Stapling, Online Certificate Status Protocol (OCSP), Organization Validation (OV) Certificate, Perfect Forward Secrecy, Root Certificate, Server Name Indication (SNI), SSL Records, Subject, Subject Alternative Name (SAN) Cert

Modules:

• SSL Overview
  • Versions
  • Key Players
  • Purpose
• Cryptography 101
  • Hashing
  • Encryption
  • Public Key Infrastructure
  • RSA Example
  • Diffie-Hellman
• X509 Certificates and Keys
  • What is in a Certificate?
  • What is in a RSA key file?
  • What is in a CSR?
  • Certificate Formats
• Security through Certificates
  • Certificate Validation
  • Certificate Chains
  • Certificate Types
  • Certificate Revocation
  • Cipher Suites
• SSL Handshake
  • SSL Messages
  • SSL Handshake
  • Handshake Variants
• Security Concerns
  • Protocol Downgrade Attack
  • CCS Injection
  • Heartbleed
  • False Chain
  • Insecure Renegotiation
  • POODLE
  • BEAST
  • CRIME