9.92 Using HTTPS for building secure web applications v 1.0

Transcription

1 LiTH 9.92 Using HTTPS for building secure web applications v 1.0 Jonas Krogell Abstract Today most websites on the Internet uses normal HTTP for displaying the data for the visitors/users. HTTP is a unsecure protocoll, for which it is possible to inject data, eavesdrop and do man-in-the-middle-attacks on. To solve this problem HTTPS was developed. HTTPS provides normal HTTP with a encryption and authentication layer. This document describes how to use HTTPS and do a simple setup using Apache and OpenSSL Using HTTPS for building secure web applications v 1.0 1

2 Field of application 1 Field of application When building a web application security is offen a critical point. There are many examples of software companys building a massive web application and put alot of effort in doing it secure, but in the end it stills run on normal HTTP which is vunerable to several attacks which is easy for an attacker to do and exploit the whole system. The most vunerable point in normal HTTP is when building a system where user accounts and passwords are used. These passowrds needs to be transfered from the clients web-browser to the web-server in a secure way so intruders cant eavesdrop and steal the accounts. Using HTTPS may prevent eavesdropping if used in a correct way. One other common problem when using web applications is if we can thrust the web application to be the one it says it is. When visiting a normal web site with HTTP there is no check that the site you see is really the one you have requested. HTTPS solves this problem with introducing certificates. The certificates works as an proof of identity for the server and is used to exchange information about encryption. If the system in mind dont need any form of protection, for example, its a read-only system where there is no personal user accounts and the users cant really do anything that could harm the system and the data presented to the users does not need to be verified for correctness. In this case HTTPS does not fullfill any needs and is just a waste of computer resources and time, but in reality there is always some kind of need for integrity and confidentiality Using HTTPS for building secure web applications v 1.0

3 Prerequisites 2 Prerequisites To be able setting up a web site using HTTPS we of course need a server which support this. Under the realization-part of this document it will be explained how to install a Apache-server with HTTPS-support. This is one of the most commonly used web servers on Internet today. One very important step when using HTTPS is to handle the certificates in a correct way and get them signed. How this is done is explained in chapter Using HTTPS for building secure web applications v 1.0 3

4 Realizaition 3 Realizaition Setting up a HTTPS-server is a two-step process. First you need to get a valid certificate, then you install in on the server. This realization will be about how this is done with OpenSSL and Apache version Certificate and key managment The first thing that needs to be done is to generate a certificate request (req) and a keyfile. openssl req -new -nodes -keyout domain.com.key -out domain.com.csr The keyfile is to be keept private and should be left as it is. Now we need to sign the certificate, here we basicly have two choices. One is to self-sign it and the other one is to get it signed by a third thrusted part. To do a self-sign is free, but then all possible clients to the server need to verify the certificate to be correct - else all security is lost. The other choice, to get it signed by a already thrusted part is recomended in most cases. There are many big companys who are ready to sign your certificate, but this is not a free service and prices may vary. This can probably be done from $100 and up. One of the biggest companys, and most well know is VeriSign. When choosing a certificate signing service the most important part is to check is if the root certificate the company will sign with is pre-installed in the majority of the modern browsers, otherwise the signing wont be very usefull for the end-users unless they manually install the root certificate. A good choice for many PUM-projects may be to get their certificate signed by Linköpings Universitet. LiU provides a free signing service, but there are some regulations about who can grant a signing from LiU. To find out if you qualify and what to do, visit the homepage of Linköpings Universitet CA ( All signing processes involves a few basic steps, these are: Setting up an agreement on what grounds the signing builds on Verification of the identification of the part wanting a sign Secure transfer of the certificate file between the parts The signing process ends when you have recieved a signed certificate file from the signing part. Do notice that all certificates do have a limited time of life before they need to be renewed. If a self-sign is desired the following OpenSSL commands is issued: Using HTTPS for building secure web applications v 1.0

5 Realizaition openssl req -in domain.com.csr -signkey domain.com.key -out domain.com.cert Now we have a certificate file that is somehow signed and a private keyfile. Be shure to protect the keyfile well, for example by setting correct file permissions: chmod 400 domain.key 3.2 Setting up apache to use the certificate To set up apache to use the correct certificate files and use SSL the following lines of configuration is needed in httpd.conf: SSLEngine on SSLCertificateFile \ /usr/local/certs/domain.com.cert SSLCertificateKeyFile \ /usr/local/certs/domain.com.key Of course its important that the paths to the certificate and keyfile are correct. Now only a restart of apache should be needed and everything should be up running. How this is done is of course very system specific. 3.3 Optional HTTP -> HTTPS redirect It may be wanted that people visiting the site using HTTP should be redirected to use HTTPS instead. This can for example be done automatically with the following setup for apache using the rewrite engine: RewriteEngine On RewriteRule ^/(.*) This config will send all requests to the correct domain using HTTPS Using HTTPS for building secure web applications v 1.0 5

6 Results 4 Results 4.1 Expected result When visiting a HTTPS-enabled web site the browser should some how indicate that HTTPS is used, usualy this is done by showing a padlock in the right corner of the browser, the URL-bar might also change color from white to yellow. But these indicators are highly browser specific. When visiting a site with a self-signed certificate there should appear a warning that tells the user that the site is using a unkown certificate. To solve this problem the certificate needs to be verifyed to be correct and then added to the users browser.templates and forms 5 Verification of the results To verify that the actual data is going on over HTTPS a network traffic analysis tool might be used, for example wireshark. To do this start wireshark and start a traffic dump. Then visit the HTTPS site from the computer running wireshark. Now you should be able to follow the flow of data in wireshark. The dataflow should in short be something like this: First a SSL-hello should be sent from client to server The server responds with a certificate and a encryption-key The client answare with a encryption-key Data begins to transfer in encrypted form After a correct SSL-handshake and exchange of encryption-keys all data should go encrypted and should be unreadable without knowing the correct private keys. If data after the handshake still is in clear text the HTTPS-installation somehow has failed. 6 Examples with explanations Section not applicable to this process Using HTTPS for building secure web applications v 1.0

7 Solutions to common problems 7 Solutions to common problems Becouse of the fact that HTTPS is HTTP with a encryption layer it will use much more CPU which may affect the performance of the web server. Solutions to this problem is to get a new server or to use a SSL-accelerator. To use shorter certificates then 128-bits becouse they need less CPU are not recomended due to the fact that they are very easy to break for an intruder. 8 Adjustment to the PUM-course Section not applicable to this process. 9 Measurements of the process To install a web server using HTTPS should be a fairly simple and fast process, and if the server has enough RAM and CPU there is really no excuse to not use HTTPS. 10 History of the process Process started by Jonas Krogell 11 Changes not yet attended to Explain how to set up other web servers like Microsoft IIS for HTTPS. More details on how to sign and get certificates signed by authoritives. Explain about client certificates and how they are used Using HTTPS for building secure web applications v 1.0 7

8 References 12 References - Linköping Universitet CA This is the web page for applications for certificate signs on LIU - The Apache Software Fundation Homepage for the Apache project, a HTTPS server - The Open Source toolkit for SSL/TLS A toolkit for generating certificates - VeriSign A company who sign certificates Using HTTPS for building secure web applications v 1.0