Skip to content

Commit b91ea16

Browse files
vlbeevlbee
authored
commit week7 folder and https.md file
1 parent 8773590 commit b91ea16

1 file changed

Lines changed: 174 additions & 0 deletions

File tree

‎week 7/httpsResearch.md‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
# HTTP vs HTTPS
2+
3+
- How does HTTPS work? What are TLS/SSL certificates?
4+
- Why is this important to implement in your projects?
5+
- Demo how to generate certificates and use them in a node project
6+
7+
8+
## What is HTTPS - A simplfied view
9+
*"HTTPS is simply your standard HTTP protocol slathered with a generous layer of delicious SSL/TLS encryption goodness. Unless something goes horribly wrong (and it can), it prevents people like the [infamous Eve](https://en.wikipedia.org/wiki/Alice_and_Bob#Cast_of_characters) from viewing or modifying the requests that make up your browsing experience; it’s what keeps your passwords, communications and credit card details safe on the wire between your computer and the servers you want to send this data to"* - [Robert Heaton](https://robertheaton.com/2014/03/27/how-does-https-actually-work/)
10+
11+
**The MDN definition:**
12+
HTTPS is an encrypted version of the HTTP protocol. It usually uses SSL or TLS to encrypt all communication between a client and a server. This secure connection allows clients to safely exchange sensitive data with a server, e.g. for banking activities
13+
14+
Servers and clients still speak exactly the same HTTP to each other, but over a secure SSL connection that encrypts and decrypts their requests and responses.
15+
16+
## What are SSL and TLS?
17+
18+
19+
SSL - Secure Sockets Layer, standard technology for keeping an internet connection secure
20+
It uses encryption algorithms to scramble data in transit, preventing hackers from reading it as it is sent over the connection.
21+
22+
TLS - (Transport Layer Security) is just an updated, more secure, version of SSL.
23+
24+
CERTIFICATE - Certificates are _public keys_ that correspond to a private key, and that are digitally signed either by a Certificate Authority or by the owner of the private key (such certificates are referred to as “self-signed”).
25+
26+
The first step to obtaining a certificate is to create a _Certificate Signing Request_ (CSR) file, which one needs to share with CA and get it signed.
27+
28+
29+
30+
---
31+
#### A Brief History of SSL and TLS and which one you should use
32+
33+
SSL and TLS are both cryptographic protocols that provide authentication and data encryption between servers, machines and applications operating over a network (e.g. a client connecting to a web server). SSL is the predecessor to TLS. Over the years, new versions of the protocols have been released to address vulnerabilities and support stronger, more secure cipher suites and algorithms. TLS is currently at v. 1.3.
34+
SSL is deprecated. You should disable SSL 2.0 and 3.0 in your server configuration, leaving only TLS protocols enabled.
35+
36+
SSL/TLS are used with **Certificates -- are not dependent on protocols**. That is, you don’t need to use a TLS Certificate vs. an SSL Certificate. While many vendors tend to use the phrase “SSL/TLS Certificate”, it may be more accurate to call them “Certificates for use with SSL and TLS
37+
38+
39+
HTTPS (Hyper Text Transfer Protocol Secure) appears in the URL when a website is secured by an SSL certificate. The details of the certificate, including the issuing authority and the corporate name of the website owner, can be viewed by clicking on the lock symbol on the browser bar.
40+
41+
42+
## How does HTTPS work?
43+
44+
An SSL connection between a client and server is set up by a 'handshake*':
45+
\*our TLS handshake occurs long before any HTTP traffic.
46+
![](https://i.imgur.com/xkGqTZe.png)
47+
48+
49+
* **Hello**
50+
* The client sends a hello message
51+
* The message contains everything the server needs to connect to the client using SSL/TLS (i.e. which encryption algorithm they will use to exchange data, maximum SSL version)
52+
* The server responds with a hello
53+
* The server's hello contains the info that client needs (i.e. a decision based on the client's preferences)
54+
55+
* **Certificate Exchange**
56+
* The server has to prove its identity to the client
57+
* It does this by using its SSL certificate (a bit like a passport)
58+
* The client checks to see if it implicitly tusts the certificate or if it is verified and trusted by a certificate authority that it trusts
59+
* The server can also require a cerficiate from the client which proves the clients identity (only used in very senstive applications)
60+
61+
* **Key Exchange**
62+
* A symmetric algorithm is used to encrypt the message data between client and server
63+
* Symmetric algorithms use **one** key for encryption and decryption - both parties have to agree on the key (this process is done securely using asymmetric encryption and the server's public/private keys)
64+
* the client generates the key using the algorithm from hello and the server's public key found on its certificate
65+
* client sends the encrypted key to the server
66+
* server decrypts key using the its private key
67+
68+
When all this is done, the client and server have completed the handshake and have verified one anothers identities.
69+
70+
Now Man In The Middle Attackers are unable to read or modify any requests that they may intercept.
71+
72+
73+
74+
75+
## Certificates
76+
* At its most basic level, an SSL certificate is simply a text file, and anyone with a text editor can create one.
77+
* So you can't trust them all!
78+
79+
* There are 2 reasons why you might trust a cerficate:
80+
* its on a list of certifcates that you trust implicity (browsers come with a list of trusted SSL certiticates from Certificate Authorties )
81+
* it’s able to prove that it is trusted by the controller of one of the certificates on the above list
82+
83+
84+
**Digitial signatures**: *The certificate in encrypted form*
85+
* **Signed certificates:**
86+
* An authority 'signs' (verifies) the certificate
87+
* The authority uses their private key to encrypt the certificate and this cipher (encrypted) text is attached to the certificate - its digital signature!
88+
* Anyone can decrypt this using the authorities public key and verify that it results in the expected decrypted value
89+
* BUT as only the authority can encrypt content (using its private key), only authorities can create valid signatures
90+
* This means that your browser has a way to verify that a certificate was signed by who its claiming to be signed by
91+
92+
* **self-signed certificates:**
93+
* all root certificates are self-signed
94+
* self-signed means that the digital signature is created using the certificate's own private key
95+
* You can generate these yourself (see our demo)
96+
* BUT as the self-signed certifcate isn't pre-loaded into browsers, none of them will trust you!
97+
98+
99+
100+
101+
## Demo - How to generate certificates and use them in a node project
102+
103+
You can generate a certificate on your local host in different ways:
104+
105+
1. Use an **npm module** like **pem** to create keys and certificates (but no CSR) https://www.npmjs.com/package/pem
106+
2. Use the **openssl command-line program**, which comes with most Linux and Mac OS X systems, to generate private/public keys and a CSR (Certificate Signing Request) needed to register your certificate with a CA (Certificate Authority) // See Google Web Fundamentals link
107+
108+
In this demo we are using pem, and adding our certificate to our local machine and browswer whitelist (rather thatn the browser checking if the certificate with valid with a CA. )
109+
110+
111+
112+
```javascript=
113+
const router = require('./router');
114+
const https = require('https');
115+
const pem = require('pem');
116+
117+
require('env2')('./config.env');
118+
119+
pem.createCertificate({ days: 1, selfSigned: true }, (err, keys) => {
120+
if (err) {
121+
throw err;
122+
}
123+
const options = {
124+
key: keys.serviceKey,
125+
cert: keys.certificate,
126+
};
127+
128+
// 443 is the standard HTTPS port, but requires root permissions on most systems
129+
// you can use a higher number port like 4300 to workaround this
130+
https.createServer(options, router).listen(443, () => {
131+
console.log('Server listening on port: 443');
132+
});
133+
134+
});
135+
136+
```
137+
138+
### Our self-signed root certificate:
139+
![](https://i.imgur.com/U1E6gH5.png)
140+
141+
### A real certificate validated by Let's Encrypt
142+
![](https://i.imgur.com/bRZC0sF.png)
143+
144+
### What can we do to use our self-signed certificate on our local machines and avoid this safety warning?
145+
![](https://i.imgur.com/sPuVnem.png)
146+
147+
148+
149+
150+
Easy fix for Chrome - **For development purposes only. NEVER USE THIS FOR PRODUCTION!)**
151+
-------------------
152+
153+
In Chrome all you need to do is to open enter this URL [chrome://flags/#allow-insecure-localhost](chrome://flags/#allow-insecure-localhost) into the address bar to find the configuration setting for allowing invalid certificates for localhost:
154+
155+
[![Chrome settings](https://improveandrepeat.com/wp-content/uploads/2016/09/SelfSigned_Chrome_Settings.png)](https://improveandrepeat.com/wp-content/uploads/2016/09/SelfSigned_Chrome_Settings.png)
156+
157+
Click on `Enable` and restart Chrome. From now on invalid certificates on localhost (and just on localhost) are ignored and you can develop with your self-signed certificate.
158+
159+
160+
161+
## Resources
162+
* [How does https actually work?](https://robertheaton.com/2014/03/27/how-does-https-actually-work/)
163+
* [SSL vs. TLS - What's the Difference?](https://www.globalsign.com/en/blog/ssl-vs-tls-difference/)
164+
* [An Introduction to Certification Authority Authorization (CAA)](https://www.ssl.com/article/certification-authority-authorization-caa/)
165+
* [How to Use SSL/TLS with Node.js](https://www.sitepoint.com/how-to-use-ssltls-with-node-js/)
166+
* [Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates](https://certbot.eff.org/)
167+
* [Lets Encrypt](https://letsencrypt.org/getting-started/)
168+
* [Heroku SSL](https://devcenter.heroku.com/articles/ssl)
169+
* [Google Web Fundamentals - Enabling HTTPS on Your Servers](https://developers.google.com/web/fundamentals/security/encrypt-in-transit/enable-https)
170+
* [npm pem](https://www.npmjs.com/package/pem)
171+
* [Stack Overflow - how to create a https server in node](https://stackoverflow.com/questions/5998694/how-to-create-an-https-server-in-node-js)
172+
* [Medium -ssl certifcated explained](https://medium.com/nodejs-tips/ssl-certificate-explained-fc86f8aa43d4)
173+
* [The First Few Milliseconds of an HTTPS Connection](http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html)
174+
* [Allowing Self-Signed Certificates on Localhost with Chrome and Firefox](https://improveandrepeat.com/2016/09/allowing-self-signed-certificates-on-localhost-with-chrome-and-firefox/)

0 commit comments

Comments
 (0)