A tutorial on how you can host mul$ple SSL Cer$ficates on a single IP address without losing any backward compa6bility

Size: px

Start display at page:

Download "A tutorial on how you can host mul$ple SSL Cer$ficates on a single IP address without losing any backward compa6bility"

Angel Randall
10 years ago
Views:

1 A tutorial on how you can host mul$ple SSL Cer$ficates on a single IP address without losing any backward compa6bility Paul van Brouwershaven Business Development Director EMEA, on TwiBer GlobalSign. A GMO Internet Inc group company.

2 Paul van Brouwershaven

3 Netherlands

4 Business Development Director Business Development Director for GlobalSign Previously CTO of a European hos6ng company Over 10 years of experience in the hos$ng industry Expert in digital cer6ficate solu6ons Dedicated to increasing awareness of the requirements for online security Thinking out of the box, detec6ng problems and providing solu6ons

5 Mul$ple SSL Cer$ficates on a single IP address

6 More demands and requirements for SSL Article 17 of Directive 95/46/EC of the European Parliament Security of processing Member States shall provide that the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.

7 Each SSL Cer$ﬁcate needs its own IP

8 Why do I need a dedicated IP address?

9 Request on a non- secure connec$on Client HTTP Request: Can you please send me /contact.html on HTTP Reply: Here is the content you requested. Server

10 Host:

11 Request on a secure connec$on Client (TLS Handshake) Hello, I support XYZ Encryp6on. Server (TLS Handshake) Hi there, here is my public cer6ficate, let s use this encryp6on algorithm. Client (TLS Handshake) Sounds good to me. Client (Encrypted) HTTP Request: Can you please send me /contact.html on Server (Encrypted) HTTP Reply: Here is the content you requested.

12 Server Name Indica$on (SNI) Client (TLS Handshake) Hello, I support XYZ Encryp6on, and I am trying to connect to Server (TLS Handshake) Hi there, here is my public Cer6ficate for and let s use this encryp6on algorithm. Client (TLS Handshake) Sounds good to me. Client (Encrypted) HTTP Request: Can you please send me /contact.html on Server (Encrypted) HTTP Reply: Here is the content you requested.

13 Request on a secure connec$on :

14 Tes$ng SNI with OpenSSL

15 The SSL/TLS handshake

16 Applica$ons with no SNI Support All versions of Internet Explorer on Windows XP Android 2.x [Gingerbread] default browser (other browsers like Opera do support SNI on Android) BlackBerry Browser Windows Mobile up to 6.5

17 Windows XP with SNI

18 Opera$ng System Usage - Win XP per con$nent 40 WinXP usage (July 2013) Africa Asia Europe North America Oceania South America 5 0 Africa Asia Europe North America Oceania South America

19 Worldwide Opera$ng System Usage - Win XP: 21%

20 Internet Explorer market share Per con$nent 35% IE market share (July 2013) 30% 25% 20% 15% 10% Africa Asia Europe North America Oceania South America 5% 0% Africa Asia Europe North America Oceania South America

21 Worldwide Internet Explorer market share 25%

22 Or 8% of your world wide visitors? 25% of 21% = 5.3% Internet Explorer Windows XP + mobile traffic = 8% of World Wide internet users do not support Server Name Indication (SNI)

23 Should I use/offer SNI for SSL sites? There is no problem when you need to secure a website or portal that is used by a closed community or business that has no Windows XP users. Provide SNI support for free with an SSL Cer6ficate Users can decide to provide an unsecure connec6on and a warning to visitors with an outdated system. Calculate an addi6onal fee for users that want to have full compa6bility and thus a dedicated IP number

24 Should I use/offer SNI for SSL sites?

25 What are the alterna$ve solu$ons?

26 A mul$- domain SSL Cer$ficate One SSL Cer6ficate for mul6ple domain names from different organisa6ons. The cer6ficate contains the hos6ng company s details. Domain control is verified for each domain.

27 Mul$- domain cer$ficates

28 Control of the Private Key A mul6- domain cer6ficate usually runs on shared hos6ng server or reversed proxy DN Domain control is validated for each SAN SSL Cer6ficate accessible by server or network administrator with root permissions Informa6on of the company that is responsible for the private key is listed in the cer6ficate contents.

29 Cer$ficate Size Test results based on number of SANs and characters Note: Average number of characters in a domain 13/14* *Source: Nominet Cer6ficate size limit is browser dependent

30 Cer$ficate Growth SAN 17 SAN 33 SAN 49 SAN 65 SAN 81 SAN 97 SAN 113 SAN 129 SAN 145 SAN 161 SAN 177 SAN 193 SAN 209 SAN 225 SAN 241 SAN 257 SAN 273 SAN 289 SAN 305 SAN 321 SAN 337 SAN 353 SAN 369 SAN 385 SAN 401 SAN 417 SAN 433 SAN 449 SAN 465 SAN 481 SAN 497 SAN 513 SAN 529 SAN 545 SAN 561 SAN 577 SAN 593 SAN 609 SAN 625 SAN 641 SAN 657 SAN 673 SAN 689 SAN 705 SAN 721 SAN 737 SAN 753 SAN 769 SAN 785 SAN 801 SAN 817 SAN 833 SAN 849 SAN 865 SAN 881 SAN 897 SAN 913 SAN 929 SAN 945 SAN 961 SAN 977 SAN 993 SAN 1 Char 2 Char 3 Char 4 Char 5 Char 6 Char 7 Char 8 Char 9 Char 10 Char 11 Char 12 Char 13 Char 14 Char 15 Char 16 Char 17 Char 18 Char 19 Char 20 Char

31 Maximum Cer$ficate Size Google Chrome, Mozilla Firefox & Opera have a limit of 174K.

32 Maximum Cer$ficate Size Internet Explorer on Windows XP SP3 till Windows 7 has a certificate size limit of 44k. Windows XP without any service packs is limited to 22k. An average OCSP stapling response is about 1k Other TLS overhead is about 0.5k

33 Performance of mul$- domain cer$ficates 750 names: 716 ms 450 names: 518 ms 1 name: 198 ms

34 Every 100ms delay costs 1% of sales

35 The disadvantages of mul$- domain certs No support for OV, EV One cer6ficate shared by many websites Many hostnames are visible in the cer6ficate Visitor needs to download a bigger cer6ficate (slower)

36 What if we could use the best of both solu$ons? 92% SNI / 8% CloudSSL

37 SNI combined with CloudSSL User requests website Secure website delivered

38 With SNI support

39 Windows XP (has no SNI support)

40 How Google Implemented this

41 Two SSL Cer$ficates for one site! No additional costs Sites can use all types of certificates (including EV) One SSL Certificate installed via the regular way, a second SSL Certificate (one per IP) can be updated automatically.

42 Environment and Plaborm independent

43 How does it work?

44 Lets create a few sites in DirectAdmin

45 Completely Automated Process

46 Automated domain control valida$on

47 User Agent Redirect

48 Same site, Different content

49 Using meta- tag authen$ca$on

50 Using meta- tag authen$ca$on

51 Thank you Paul van

Managing IPv4 scarcity when using SSL Cer7ficates Mul7ple SSL Cer7ficates on a single IP address

GlobalSign. A GMO Internet Inc group company. Managing IPv4 scarcity when using SSL Cer7ficates Mul7ple SSL Cer7ficates on a single IP address Paul van Brouwershaven Business Development Director EMEA,