SSL(secure socket layer,\u5b89\u5168\u901a\u9053\u5c64)
\u7528\u65bchttp\u7684port\u70ba443
\u7531Netscape Communications\u958b\u767c
\u7528\u4f86\u5c0d\u7db2\u969b\u7db2\u8defsession\u63d0\u4f9b\u5b89\u5168\u6027\u548c\u4fdd\u5bc6\u6027\u7684handshake\u5354\u5b9a<\/p>\n\n\n\n
\u539f\u7406: \u529f\u80fd<\/strong> SSL connection<\/strong>:\u4e00\u500b\u9023\u7d50\u8868\u4e00\u500b\u50b3\u8f38\u7a0b\u5e8f,\u9ede\u5c0d\u9ede\u7684\u66ab\u6642\u95dc\u4fc2,\u4e26\u5c0d\u61c9\u5230SSL session SSL session<\/strong>:\u4ecb\u65bc\u5169\u7aef\u9593\u6709\u4e0d\u540c\u72c0\u614b,\u7531handshake(\u63e1\u624b\u5354\u5b9a)\u7522\u751f,\u4e26\u5b9a\u7fa9\u4e00\u7d44\u80fd\u88ab\u591a\u9023\u7d50\u5171\u4eab\u7684\u5b89\u5168\u53c3\u6578 SSL(secure socket layer,\u5b89\u5168\u901a\u9053\u5c64) …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[10],"tags":[],"class_list":["post-429","post","type-post","status-publish","format-standard","hentry","category-securitysloution"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=429"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/429\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u52a0\u5bc6\u8cc7\u6599(\u4f7f\u7528\u975e\u5c0d\u7a31\u52a0\u5bc6) <\/strong>
1.server\u7aef\u5c07\u6191\u8b49\u4e2d\u7684publick key\u7d66\u5ba2\u6236\u7aef
2.\u5ba2\u6236\u7aef\u7528\u8a72public key\u5c07\u8a0a\u606f\u52a0\u5bc6\u7d66server\u7aef
3.server\u7aef\u5c07\u52a0\u5bc6\u8cc7\u6599\u7528private key\u89e3\u5bc6
ps:server\u7aef\u767c\u51fa\u7684public key\u6bcf\u4e00\u6bb5\u6642\u9593\u6703\u6539\u8b8a
\u9a57\u8b49server(\u4f7f\u7528\u4e0d\u53ef\u5426\u8a8d\u6027\u6280\u8853) <\/strong>
1.\u5ba2\u6236\u7aef\u6703\u53bb\u770bserver\u7aef\u6191\u8b49\u7684\u7c3d\u767c\u55ae\u4f4d\u53ef\u9760\u6027
2.\u82e5\u78ba\u5b9a\u53ef\u9760\u5247\u700f\u89bd\u5668\u6703\u986f\u793a\u5b89\u5168,\u82e5\u4e0d\u78ba\u5b9a\u5247\u700f\u89bd\u5668\u6703\u986f\u793a”\u9019\u500b\u7db2\u7ad9\u4e0d\u5b89\u5168” <\/p>\n\n\n\n
\u652f\u63f4\u4f3a\u670d\u5668\u548c\u5ba2\u6236\u7aef\u8a8d\u8b49\uff0c\u4e26\u88ab\u8a2d\u8a08\u6210\u5354\u5546\u52a0\u5bc6\u91d1\u9470\u53ca\u5728\u4ea4\u63db\u4efb\u4f55\u8cc7\u6599\u4e4b\u524d\u8a8d\u8b49\u4f3a\u670d\u5668\u3002\u4f7f\u7528\u52a0\u5bc6\u3001\u8a8d\u8b49\u548cMAC\u4f86\u7dad\u8b77\u50b3\u8f38\u4fe1\u9053\u7684\u5b8c\u6574\u6027
\u5efa\u7f6e\u65bcSocket\u5c64,\u61c9\u7528\u5728\u50b3\u8f38\u5c64,\u4e3b\u8981\u529f\u80fd\u662f\u5efa\u7acb\u5b89\u5168\u7684\u9023\u7dda,\u4ee5\u6191\u8b49\u70ba\u4e3b\u7684\u9a57\u8b49
\u5229\u7528tcp\u4f86\u63d0\u4f9b\u9ede\u5c0d\u9ede\u5b89\u5168\u670d\u52d9,\u652f\u63f4\u61c9\u7528\u5c64\u5354\u5b9aex;http,ftp,smtp.ssh<\/p>\n\n\n\n
\u4f3a\u670d\u7aef\u8207\u5ba2\u6236\u7aef\u4e82\u6578\uff1a\u5c0d\u6bcf\u500b\u9023\u7d50\u6240\u9078\u53d6\u7684\u4f4d\u5143\u7d44\u5e8f\u5217
\u7531\u4f3a\u670d\u7aef\u5beb\u5165mac\u79d8\u5bc6\uff1a\u5c0d\u9001\u51fa\u8cc7\u6599\u7522\u751fmac\u7528\u7684\u79d8\u9470
\u7531\u5ba2\u6236\u7aef\u5beb\u5165mac\u79d8\u5bc6\uff1a\u5c0d\u9001\u51fa\u8cc7\u6599\u7522\u751fmac\u7528\u7684\u79d8\u9470
\u4f3a\u670d\u7aef\u5beb\u5165\u9470\u5319\uff1a\u7d66\u5ba2\u6236\u7aef\u7528\u4f86\u89e3\u5bc6\u7684key
\u5ba2\u6236\u7aef\u5beb\u5165\u9470\u5319\uff1a\u7d66\u4f3a\u670d\u7aef\u7528\u4f86\u89e3\u5bc6\u7684key
\u555f\u59cb\u5411\u91cf\uff1a\u521d\u59cb\u503c\u7531\u63e1\u624b\u5354\u5b9a\u8a2d\u5b9a
\u5e8f\u865f\uff1a\u5c0d\u4e0d\u540c\u9023\u7d50\u767c\u51fa\/\u63a5\u6536\u7684\u8a0a\u865f<\/p>\n\n\n\n
\u901a\u8a0a\u8b58\u5225\u78bc\uff1a\u4f3a\u670d\u7aef\u9078\u4e00\u4f4d\u5143\u7d44\u5e8f\u5217\u8fa8\u8b58\u901a\u8a0a\u72c0\u614b
\u5c0d\u7b49\u8a8d\u8b49\uff1aX509v3\u5c0d\u901a\u8a0a\u96d9\u65b9\u7684\u8a8d\u8b49
\u58d3\u7e2e\u65b9\u6cd5\uff1a\u52a0\u5bc6\u524d\u7684\u58d3\u7e2e\u6f14\u7b97\u6cd5
\u5bc6\u6587\u898f\u683c\uff1a\u6307\u5b9a\u52a0\u5bc6\u6f14\u7b97\u6cd5
\u4e3b\u8981\u79d8\u5bc6\uff1a\u5b9a\u7fa9\u5ba2\u6236\u7aef\u8207\u4f3a\u670d\u7aef\u5171\u4eab\u79d8\u5bc648byte
\u662f\u5426\u53ef\u56de\u8986\uff1a\u8868\u53ef\u5426\u7528\u9019\u500b\u901a\u8a0a\u5efa\u7acb\u65b0\u9023\u7d50
SSL\u7531\u5169\u5c64\u5354\u5b9a\u7d44\u6210\uff1a
\u9ad8\u5c64\u5354\u5b9a(\u7ba1\u7406ssl\u901a\u8a0a)<\/strong>
\u3000handshake protocol(\u63e1\u624b\u5354\u5b9a)\uff1a1byte\u985e\u578btype(\u6709\u5341\u7a2e)+3byte\u9577\u5ea6length+1byte\u4ee5\u4e0acontent(\u5167\u5bb9)
\u3000\u3000\u50b3\u9001\u8cc7\u6599\u524d\u9808\u7528\u6b64\u5354\u5b9a\u8b93\u7528\u6236\u7aef\u548c\u4f3a\u670d\u5668\u78ba\u4efb\u5f7c\u6b64\u8eab\u4efd,\u4e26\u8b93\u96d9\u65b9\u9078\u52a0\u5bc6\u6f14\u7b97\u6cd5,mac\u6f14\u7b97\u6cd5,\u76f8\u95dc\u91d1\u9470
\u3000change cipher spec protocol(\u5bc6\u6587\u898f\u683c\u8b8a\u66f4\u5354\u5b9a)\uff1a\u8a0a\u606f\u53ea\u542b1byte
\u3000\u3000\u8b93pending state(\u96a8\u5f8c\u72c0\u614b)\u80fd\u5920\u8907\u88fd\u5230current state(\u76ee\u524d\u72c0\u614b)\u4e2d,\u5373\u53ef\u66f4\u65b0\u76ee\u524d\u9023\u7dda\u6240\u7528\u52a0\u5bc6\u6f14\u7b97\u6cd5
\u3000alert protocol(\u8b66\u544a\u5354\u5b9a)\uff1a1byte\u8b66\u6212\u7b49\u7d1alevel+1byte\u8b66\u8a0a\u4ee3\u78bcalter,\u53ef\u7528\u4f86\u50b3\u9001\u76f8\u95dc\u8b66\u8a0a\u7d66\u9023\u7dda\u5c0d\u65b9
\u3000\u3000level\u7684\u503c\u6709warning(1,\u4e0d\u7522\u751f\u4efb\u4f55\u65b0\u9023\u7dda)\u548cfatal(2,\u99ac\u4e0a\u4e2d\u65b7)
tcp\u4e0a\u5c64<\/strong>
\u3000SSL record protocol(\u8a18\u9304\u5354\u5b9a)\uff1a\u63d0\u4f9b\u57fa\u672c\u5b89\u5168\u670d\u52d9\u8b93\u9ad8\u5c64\u5354\u5b9a\u4f7f\u7528
\u3000\u4fdd\u5bc6\u6027\uff1a\u63e1\u624b\u5354\u5b9a\u5b9a\u7fa9\u4e00\u628a\u50b3\u7d71\u52a0\u5bc6\u6cd5\u7684\u5171\u4eab\u79d8\u5bc6\u9470\u5319
\u3000\u8a0a\u606f\u5b8c\u6574\u6027\uff1a\u63e1\u624b\u5354\u5b9a\u5b9a\u7fa9\u4e00\u628a\u7522\u751f\u8a0a\u606f\u78ba\u8a8d\u78bc\u7684\u5171\u4eab\u79d8\u5bc6\u9470\u5319
ssl \u8a18\u9304\u5354\u5b9a\u904b\u4f5c\u6d41\u7a0b<\/strong>
1\u5207\u5272\uff1a\u6703\u5c07\u4e0a\u5c64\u6b32\u50b3\u9001\u7684\u8a0a\u606f(ex:http,handshake\u5354\u5b9a,alter\u5354\u5b9a..\u7b49\u9ad8\u5c64\u5354\u5b9a)\u5207\u5272\u6700\u591a2^14\u4f4d\u5143\u7d44
2\u58d3\u7e2e\uff1a\u7121\u640d\u5931\u58d3\u7e2e,\u9078\u64c7\u6027
3\u52a0\u5165MAC:\u8a08\u7b97\u8a0a\u606f\u8a8d\u8b49\u78bc\u4e26\u52a0\u5165\u5728\u7247\u6bb5\u5f8c,SSLv3\u4f7f\u7528HMAC
4\u52a0\u5bc6\uff1a\u53ef\u4f7f\u7528
\u5340\u584a\u52a0\u5bc6\uff1aIDEA-128key,RC2-40key,DES-40key,DES-56key,3DES-168key,Fortezza-80key
\u4e32\u6d41\u52a0\u5bc6\uff1aRC4-40key,RC4-128key
5\u52a0\u5165ssl header
content type(\u8cc7\u6599\u985e\u578b):8bit,\u7528\u4f86\u8655\u7406\u9019\u500b\u5207\u5272\u5340\u584a\u7684\u4e0a\u5c64\u5354\u5b9a
major version(\u4e3b\u8981\u7248\u672c\u865f\u78bc):8bit,\u4f7f\u7528ssl\u5354\u5b9a\u7684\u4e3b\u8981\u7248\u672c\u865f\u78bc,sslv3\u662f3
minor version(\u6b21\u8981\u7248\u672c\u865f\u78bc):8bit,\u4f7f\u7528\u7684\u6b21\u8981\u7248\u672c\u865f\u78bc,sslv3\u662f0
compressed length(\u58d3\u7e2e\u5f8c\u7684\u8cc7\u6599\u9577\u5ea6)\uff1a16bit\u5340\u584a\u4f4d\u5143\u9577\u5ea6,\u6700\u5927\u503c\u662f2^14+2048
SSL\u4ea4\u63e1\u5354\u5b9a\u904b\u4f5c\u6d41\u7a0b<\/strong>
\u7b2c\u4e00\u968e\u6bb5\uff1aHello Phase(\u554f\u5019\u968e\u6bb5)
\u7b2c\u4e8c\u968e\u6bb5\uff1aKey Exchange(\u91d1\u9470\u4ea4\u63db)
\u7b2c\u4e09\u968e\u6bb5\uff1aSession Key Production(\u88fd\u9020\u4ea4\u8ac7\u91d1\u9470)
\u7b2c\u56db\u968e\u6bb5\uff1aServer Verify(\u4f3a\u670d\u5668\u9a57\u8b49)
\u7b2c\u4e94\u968e\u6bb5\uff1aClient Authentication(\u7528\u6236\u9451\u5225)
\u7b2c\u516d\u968e\u6bb5\uff1aFinished Phase(\u5b8c\u6210\u968e\u6bb5)
…………………
OpenSSL
\u958b\u653e\u539f\u59cb\u78bc\u7684SSL\u5957\u4ef6\uff0c\u5176\u51fd\u5f0f\u5eab\u662f\u4ee5C\u8a9e\u8a00\u6240\u5beb\u6210\uff0c\u5be6\u4f5c\u4e86\u57fa\u672c\u7684\u50b3\u8f38\u5c64\u8cc7\u6599\u52a0\u5bc6\u529f\u80fd\u3002
\u96d6\u7136\u6b64\u8edf\u9ad4\u662f\u958b\u653e\u539f\u59cb\u78bc\u7684\uff0c\u4f46\u56e0\u70ba\u5176\u6388\u6b0a\u66f8\u689d\u6b3e\u8207GPL\u6709\u885d\u7a81\u4e4b\u8655\uff0c\u56e0\u6b64\u4e26\u4e0d\u662f\u81ea\u7531\u8edf\u9ad4\u3002
\u63d0\u4f9b\u4e86\u4e00\u500b\u666e\u901a\u7684\u5bc6\u78bc\u5eab\uff0c\u5c31\u8c61SSLv2\/SSLv3\uff0c\u548cTLSv1\u7db2\u7d61\u5b89\u5168\u5354\u8b70
\u9664\u4e86\u662f\u500blibrary\u5916\uff0c\u9084\u63d0\u4f9b\u4e86CLI(command line interface)\u64cd\u4f5c\uff0c\u53ef\u900f\u904eopenssl\u9019\u96bb\u7a0b\u5f0f\u5c0d\u6a94\u6848\u52a0\u5bc6\u89e3\u5bc6<\/p>\n","protected":false},"excerpt":{"rendered":"