Skip to content

🔒 SSL/TLS

A comprehensive reference for working with SSL/TLS, certificates, and OpenSSL.

📌 Core Concepts

  • SSL vs TLS
  • SSL (Secure Sockets Layer) → Deprecated

  • TLS (Transport Layer Security) → Modern, secure replacement (use TLS 1.2 or 1.3)

  • Encryption Types

  • Asymmetric (Public/Private Key): Used in the handshake for authentication.

  • Symmetric (Shared Key): Used for fast bulk data encryption after handshake.

  • Digital Certificates

  • Prove ownership of a domain/organization.
  • Issued and validated by Certificate Authorities (CAs).

  • Contain public key + metadata (subject, issuer, validity period, etc.).

  • Chain of Trust

  • Root CA → Intermediate CA(s) → Server Certificate
  • Clients must trust the Root CA.

🔧 OpenSSL Essentials

🔑 Key Management

Generate a 2048-bit private key: 

openssl genrsa -out private.key 2048
````

Generate a 4096-bit RSA key (stronger):

```bash
openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:4096

Generate an EC (Elliptic Curve) key:

openssl ecparam -genkey -name prime256v1 -noout -out private.key

📝 Certificates

Generate a Certificate Signing Request (CSR):

openssl req -new -key private.key -out request.csr

Create a Self-Signed Certificate (valid 365 days):

openssl req -x509 -new -nodes -key private.key -sha256 -days 365 -out cert.pem

View Certificate Details:

openssl x509 -in cert.pem -noout -text

Check Expiry Date:

openssl x509 -enddate -noout -in cert.pem

Verify CSR contents:

openssl req -in request.csr -noout -text

🔍 Validation

Check if private key and certificate match:

openssl rsa -noout -modulus -in private.key | openssl md5
openssl x509 -noout -modulus -in cert.pem | openssl md5

Test SSL/TLS handshake with server:

openssl s_client -connect example.com:443

Test specific protocol:

openssl s_client -connect example.com:443 -tls1_2

Check OCSP status (revocation):

openssl ocsp -issuer intermediate.pem -cert cert.pem -url http://ocsp.int-x3.letsencrypt.org

📂 File Formats

Extension Description
.key Private key
.csr Certificate Signing Request
.crt / .cer Certificate (X.509)
.pem Base64-encoded key/cert (common on Linux)
.der Binary format certificate (common on Windows/Java)
.pfx / .p12 PKCS#12 bundle (certificate + private key, often for Windows/IIS)
.jks Java Keystore

🔒 Cipher Suites & Protocols

  • Prefer TLS 1.3 (or at least TLS 1.2).

  • Disable weak/obsolete protocols:

  • SSLv2, SSLv3, TLS 1.0, TLS 1.1

  • Disable weak ciphers:

  • RC4, DES, 3DES, EXPORT, NULL

  • Strong ciphers (examples):

  • ECDHE-ECDSA-AES256-GCM-SHA384

  • ECDHE-RSA-AES128-GCM-SHA256

Check available ciphers:

openssl ciphers -v 'ALL:eNULL' | column -t

🛠️ Server Config Snippets

Apache (httpd.conf / ssl.conf)

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES:!RC4
SSLHonorCipherOrder on

Nginx (nginx.conf)

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

🛡️ Best Practices

  • Always use TLS 1.2 or TLS 1.3.
  • Use 2048+ bit RSA or Elliptic Curve (P-256, P-384) keys.
  • Enable Perfect Forward Secrecy (PFS) (via ECDHE).
  • Automate renewal with Let’s Encrypt / Certbot.
  • Rotate certificates before they expire.

  • Regularly audit SSL/TLS config with:

  • SSL Labs Server Test

  • testssl.sh

📚 Useful Tools

  • OpenSSL → Core SSL/TLS toolkit
  • Certbot → Free automated TLS certs from Let’s Encrypt
  • mkcert → Local development trusted certificates
  • sslscan / testssl.sh → Scan SSL/TLS configurations
  • keytool → Manage Java Keystores
  • cfssl → PKI/TLS toolkit by Cloudflare

🔄 Typical Workflow for Production

  1. Generate private key

openssl genrsa -out private.key 2048
2. Generate CSR

openssl req -new -key private.key -out request.csr
3. Submit CSR to CA

  • Commercial CA (DigiCert, GlobalSign, etc.)
  • Free CA (Let’s Encrypt via Certbot)

  • Receive signed certificate

  • cert.pem (your cert)

  • chain.pem (intermediate certs)
  • fullchain.pem (cert + intermediates)
  • Deploy to server with private key + cert + chain.
  • Test setup:
openssl s_client -connect yourdomain.com:443

📊 TLS Handshake (Simplified)

sequenceDiagram
    participant Client
    participant Server

    Client->>Server: ClientHello (supported ciphers, TLS version, random)
    Server->>Client: ServerHello (chosen cipher, cert, random)
    Client->>Server: Verify cert, send pre-master secret (encrypted with server’s public key)
    Server->>Client: Decrypts with private key, derives session key
    Note over Client,Server: Both sides now have the same symmetric key
    Client->>Server: Finished (encrypted)
    Server->>Client: Finished (encrypted)
    Note over Client,Server: Secure symmetric encryption begins