SSL: What is it, How to do it, and Why you should care
•Download as PPTX, PDF•
1 like•262 views
Presentation at WordCamp Chicago 2017 by Jessica Gardner
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to SSL: What is it, How to do it, and Why you should care
Similar to SSL: What is it, How to do it, and Why you should care (20)
Recently uploaded
Recently uploaded (20)
SSL: What is it, How to do it, and Why you should care
- 1. SSL: What it is, How to do it, & Why you should care WordCamp Chicago 2017
- 2. Hello! A bit about me… @jessicacgardner
- 3. 1. SSL: What it is
- 4. HTTP Review
- 6. HTTPS
- 7. The 3 main things ◎Authentication and Verification ◎Privacy/Data Encryption ◎Data Integrity
- 8. Jargon & Acronyms ◎SSL – Secure Socket Layer ◎TLS – Transport Layer Security ◎HTTPS – Hypertext Transfer Protocol Secure ◎PKI – Public Key Infrastructure ◎CA – Certificate Authority ◎CSR – Certificate Signing Request
- 12. 2. Why you should care
- 13. Who Needs It? ◎E-Commerce– PCI Compliance ◎Entertainment- DRM ◎Market Research ◎Productivity ◎Social Media ◎Education/Testing ◎Sensitive Form Data
- 17. 3. How to do it
- 18. You’ll Need…
- 19. Certificate contents ◎Domain name (common name) ◎Public key ◎Owner of certificate (subject) ◎Issuer of certificate (CA) ◎Expiration data ◎Serial number
- 20. Types of Certificates ◎Domain Validation – CA checks right of applicant to use domain name ◎Organization Validation – CA does above + vets organization ◎Extended Validation – CA does above + thorough vetting of organization
- 21. Self-Signed vs Trusted CA ◎Self-Signed: generally used for testing. Offers encryption but not validation. Will give errors.
- 22. Trusted Certificate Authorities ◎Client (browser) checks certificate validity ◎OCSP request (Online Certificate Status Protocol) ◎CRL – Certificate Revocation List ○If revoked, client returns error ○If clear, communications proceed
- 26. Let’s Encrypt (Yes, Let’s!) ◎Free, automated, open certificate ◎Non-profit Internet Security Research Group ◎Domain validation ◎No warranty ◎3-month expiry
- 27. ◎Update Site URL from http:// to https:// ◎Force http requests to https
- 28. Issues and Caveats ◎Moving a site ◎Cloud Proxy ◎Mixed/Unsecure content
- 29. Removing SSL ◎wp-config.php ◎.htaccess ◎Updating site URL (functions.php)
- 32. Thanks! Any questions? You can find me at: @jessicacgardner jessica@btwrx.com
- 33. Resources ◎SSL Server Test: https://www.ssllabs.com/ssltest/ ◎Why No Padlock? https://www.whynopadlock.com/ ◎CryptoReport https://cryptoreport.websecurity.symantec.com/ checker/