TLS - SSL #

Problem #

If a website uses HTTP without SSL/TLS, all packets sent over the internet can easily be captured and read (see packet sniffing demonstration)
How can a user determine if the website they are currently visiting is the original or a look-alike website created by a hacker to impersonate it? (see dns poisoning demonstration)

Overview #

The internet’s official birthday is January 1, 1983
A protocol for encrypting, securing, and authenticating communications that take place on the Internet
SSL was replaced by an updated protocol called TLS some time ago, SSL is still a commonly used term for this technology

evolution

To see which TLS version of a website (on Chrome):
1. Open the Developer Tools (Ctrl+Shift+I)
2. Select the Security tab
3. Navigate to the Origin you want to inspect
4. At the Connection section, check the results which TLS protocol is used

TLS 1.2 #

Key exchange algorithm: Utilize the encryption and decryption capabilities of asymmetric encryption
Round trip time: 2 RTT
Compatibility: Supported by both older and newer versions of all browsers

Flow #

tls_1_2_flow

Set up your server using TLS 1.2 #

Nginx

Open Your Nginx Configuration

sudo vi /etc/nginx/sites-enabled/default

Update the ssl_protocols directive and configure cipher suites:
- ssl_protocols TLSv1.2;
- ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256';
- When you set up a free SSL certificate with Certbot (Let’s Encrypt certificate), Certbot automatically sets up ssl_protocols and ssl_ciphers for you (include /etc/letsencrypt/options-ssl-nginx.conf;). I commented this out to allow my demo to work correctly

server {
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mnptt.io.vn/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mnptt.io.vn/privkey.pem; # managed by Certbot
    #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    # Downgrade to TLS 1.2
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256';

    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name mnptt.io.vn;

    location / {
        try_files $uri $uri/ =404;
    }
}

Test the configuration

sudo nginx -t

Reload Nginx

sudo systemctl reload nginx

Verify

tls_1_2_setup

TLS 1.3 #

Key exchange algorithm: Diffie-Hellman, Elliptic-curve Diffie-Hellman (ECDH)
Round trip time: 1 RTT
Compatibility: Supported by newer versions of most browsers

Flow #

tls_1_3_flow

Set up your server using TLS 1.3 #

Nginx

Requirements
- OpenSSL: 1.1.1 or newer
- Nginx: 1.13.0 or newer
Open Your Nginx Configuration

sudo vi /etc/nginx/sites-enabled/default

Update the ssl_protocols directive and configure cipher suites:
- ssl_protocols TLSv1.3 TLSv1.2;
- ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
- When you set up a free SSL certificate with Certbot (Let’s Encrypt certificate), Certbot automatically sets up ssl_protocols and ssl_ciphers for you (include /etc/letsencrypt/options-ssl-nginx.conf;). I commented this out to allow my demo to work correctly

server {
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mnptt.io.vn/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mnptt.io.vn/privkey.pem; # managed by Certbot
    #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    # Override settings for TLS 1.3
    ssl_protocols TLSv1.2 TLSv1.3;  # Enable TLS 1.3 and keep TLS 1.2
    ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name mnptt.io.vn;

    location / {
        try_files $uri $uri/ =404;
    }
}