Debugging TLS/SSL
summary
Claims that many developers cannot debug TLS and shows concrete fixes: check certificate formats (PEM/DER, PKCS#1 vs PKCS#8, PKCS#12, Java keystores), inspect chains and extensions (CA bit, key usage), and verify hostnames because hostname verification is often omitted and OpenSSL does not do it by default. Use practical tools: curl -v, openssl s_client, sslyze, Wireshark and SSL Labs to reveal expired certs, missing intermediates, weak ciphers and misconfigured SNI; TLS 1.2 is current and TLS 1.3 is draft.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:15Braintree
- 2:30History and Background
- 11:33Working with Key Files
- 14:25Working with Certificates
- 18:50Debugging Connections
- 21:54How TLS Works
- 23:33TLS Verification
- 24:07Chain of Trust
- 25:50TLS Server Settings generator
- 26:12Questions
related talks
46mMastering TLS, OpenSSL and Certificates
44mSSL/TLS for Mortals
50mSSL/TLS for Mortals
56mSSL/TLS for Mortals
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
51mUnderstanding TLS certificate validation errors
30mHashiTLS: Demystifying Security Certs
25mUntangling the certificate error messages