Securing the network communication using One-way SSL & Two-way SSL | MuleSoft Mysore Meetup #18 Event Link:- https://meetups.mulesoft.com/events/details/mulesoft-mysore-presents-learn-more-about-securing-the-network-communication-using-one-way-ssl-two-way-ssl/ -What is SSL/TLS ? -What is a Digital Certificate? -How to implement one-way SSL? -How to implement two-way SSL? Mysore WhatsApp group:- https://chat.whatsapp.com/EhqtHtCC75vCAX7gaO842N Youtube:- youtube.com/@mulesoftmysore Speaker:- Shaik Irfan Ahamed:- https://www.linkedin.com/in/shaik-irfan-ahamed-13a479117/ Organizers:- Shubham Chaurasia - https://www.linkedin.com/in/shubhamchaurasia1/ Giridhar Meka - https://www.linkedin.com/in/giridharmeka

1. 1

2. December 08, 2022
Mysore MuleSoft Meetup
Implementing one-way & two-way SSL

3. 3

4. Safe Harbour Statement
● Both the speaker and the host are organizing this meet-up in individual capacity only.
We are not representing our companies here.
● This presentation is strictly for learning purposes only.
● Organizer/Presenter do not hold any responsibility that same solution will work for
your business requirements.
● This presentation is not meant for any promotional activities.
4

5. A recording of this meetup will be uploaded to events page within 24 hours.
Questions can be submitted/asked at any time in the Chat/Questions & Answers Tab.
Make it more Interactive!!!
Give us feedback! Rate this meetup session by filling feedback form at the end of the day.
We Love Feedbacks!!! Its Bread & Butter for Meetup.
Housekeeping
5

6. Introduction
● About the Organizers
6
Shubham Chaurasia
Billennium India
Pro Integration Developer
A SHOW OF HANDS:
Who is new to this Meetup?
Giridhar Meka
Sr. Technical Architect
linkedin.com/in/giridharmeka
linkedin.com/in/shubhamchaurasia1

7.  3.6 years of working experience as MuleSoft Developer
 Certified MuleSoft Developer and Integration Architect
 Currently working for HashedIn By Deloitte as Senior
Software Engineer
7
Shaik Irfan Ahamed
Sr. Software Engineer
Introduction
● About the Speaker

8. Agenda
● Introductions
o What is SSL/TLS ?
o What is a Digital Certificate?
o How to implement one-way SSL?
o How to implement two-way SSL?
● Demo
● Trivia
8

9. SSL/TLS :
SSL (Secure Sockets Layer) and its successor, TLS (Transport Layer Security), are protocols for
establishing authenticated and encrypted links between networked computers
HTTPS:
Hypertext Transfer Protocol Secure (https) is a combination of HTTP with the SSL/ TLS protocol
9

10.  Confidentiality – Provided by Encryption
 Integrity – Provided by Hashing technique
 Authentication – Provided by Certificates
SSL/TLS Handshake
10
SSL/TLS has 3 Goals

11. Confidentiality
 Confidentiality can be achieved by Encryption
 There are two types of encryption in widespread use today: symmetric and
asymmetric encryption.
 Symmetric encryption uses a single key to both encrypt and decrypt data
 Asymmetric encryption uses a different keys (public-private keypair) to encrypt
 Asymmetrical encryption is used to initialize the encrypted conversation between two
users, while symmetrical encryption is used for the duration of the communication.
11

12. Integrity
12

13. Integrity…
 Hashing is used to provide Integrity
 Both parties establish a mutual secret key
 Sender combines Message + Secret key to create Digest
 Receiver verifies by calculating hash of Message + secret key
13

14. Authentication
 Prove your Identity
 Digital Certificate is needed to prove the Identity
 Digital Signature itself does not verify the actual identity of the sender
14
Alice
Alice

15. Digital Certificates
Digital certificates are electronic credentials issued by a trusted third-party, it verifies the
identity of the owner and the owner public key
15

16. SSL Handshake Protocol
 The user initiates the connection by typing the website address. The browser initiates
SSL/TLS communication by sending a message to the website’s server.
 The website's server sends back the public key or certificate to the user's browser.
 User's browser checks for a public key or certificate. If it is ok, it creates a symmetric
key and sends it back to the website's server. If the certificate is not ok, the
communication fails.
 On receiving the symmetric key, the website's server sent the key and encrypted the
requested data.
 The user's browser decrypts the content using a symmetric key, which completes the
SSL/TLS handshake. The user can see content as now connection is established
16

17. SSL Handshake Protocol…
17

18. Keystore & Truststore
 Keystore is used to store private key and identity certificates that a specific program
should present to both parties (server or client) for verification.
 Truststore is used to store certificates from Certified Authorities (CA) that verify the
certificate presented by the server in SSL connection.
18

19. One-Way SSL
 Client requests for data on HTTPS protocol to the server. That going to initiates the
SSL/TLS handshake process.
 Server returns with its public certificate and public key to the client along with the
server hello message
 The client validates/verifies the received server certificates with CA’s certification
authority
 The client sends back with a symmetric session key using the server’s public key
 The server decrypts the symmetric session key using its private key and sends back
an encrypted session key to start the encrypted session
19

20. One-Way SSL…
20

21. Two-way SSL
 Client requests for data on HTTPS protocol to the server.
 Server returns with its public certificate and public key to the client along with the
server hello message.
 The client validates/verifies the received server certificates with CA’s certification
authority
 The client sends back a client certificate with a symmetric session key using the
server’s public key.
 The server validates/verifies the received client certificates with CA’s certification
authority
 After completion of the handshake process, client and server communicate and
transfer data with each other encrypted with the secret keys shared between the two
during a handshake
21

22. Two-way SSL…
22

23. Demo

24. Q&A

25. Take a stand !
● Nominate yourself for the next meetup speaker and suggest a topic as well.
25

26. ● Share:
○ Tweet using the hashtag #MuleSoftMeetups
○ Join Mysore Group: https://meetups.mulesoft.com/mysore/
● Feedback:
○ Fill out the survey feedback and suggest topics for upcoming events
○ Contact MuleSoft at meetups@mulesoft.com for ways to improve the program
○ Reach out to Mysore Meetup Leaders (Shubham/Giridhar) to suggest
topics for next Meetup
What’s next?
26

27. Get ready to WIN a MuleSoft Voucher from MuleSoft
Quiz Time

28. Thank you