SSL

What is SSL?

SSL (Secure Sockets Layer) is a cryptographic protocol originally developed by Netscape in the 1990s to provide secure communication over computer networks. While SSL has been deprecated and replaced by TLS (Transport Layer Security), the term “SSL” is still commonly used to refer to both SSL and TLS protocols.

SSL vs TLS

SSL Versions

• SSL 1.0: Never released (security flaws)
• SSL 2.0: Deprecated in 2011 (DROWN attack)
• SSL 3.0: Deprecated in 2015 (POODLE attack)

TLS Versions

• TLS 1.0: Deprecated 2020
• TLS 1.1: Deprecated 2020
• TLS 1.2: Still supported (2008)
• TLS 1.3: Current standard (2018)

SSL/TLS Handshake

1. Client Hello
   → Supported cipher suites
   → Random number

2. Server Hello
   ← Selected cipher suite
   ← SSL certificate
   ← Server random number

3. Key Exchange
   → Client generates pre-master secret
   → Encrypts with server's public key

4. Session Keys
   Both parties derive session keys

5. Finished Messages
   Encrypted communication begins

”SSL Certificate”

Despite the name, modern “SSL certificates” actually enable TLS connections:

# Certificate works with TLS 1.2 and 1.3
openssl s_client -connect example.com:443 -tls1_3

Configuring SSL/TLS

Web Server (Nginx)

server {
    listen 443 ssl http2;
    server_name example.com;

    # Modern TLS only
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # Strong cipher suites
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
}

Application (Node.js)

import https from 'https';
import fs from 'fs';

const options = {
  key: fs.readFileSync('private-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
  // Use TLS 1.2+ only
  minVersion: 'TLSv1.2',
  // Strong ciphers
  ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256'
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('Secure connection');
}).listen(443);

SSL/TLS Best Practices

1. Use TLS 1.2 or Higher

# Disable old SSL/TLS
ssl_protocols TLSv1.2 TLSv1.3;

2. Strong Cipher Suites

ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;

3. HSTS (HTTP Strict Transport Security)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

4. Certificate Management

# Automated renewal with Let's Encrypt
certbot renew --quiet

Testing SSL/TLS Security

# Test SSL/TLS configuration
openssl s_client -connect example.com:443

# Check supported protocols
nmap --script ssl-enum-ciphers -p 443 example.com

# Online tools
# - SSL Labs (ssllabs.com)
# - testssl.sh

Common SSL/TLS Issues

Mixed Content

<!-- HTTPS page loading HTTP resource -->
<script src="http://example.com/script.js"></script>
<!-- Blocked by browser -->

Certificate Errors

• Expired certificate
• Self-signed certificate
• Domain mismatch
• Untrusted CA

SSL/TLS with CorsProxy

// CorsProxy uses modern TLS
const response = await fetch(
  'https://corsproxy.io/?url=https://api.example.com',
  {
    headers: {
      'x-cors-api-key': process.env.CORS_API_KEY
    }
  }
);

// Automatic TLS 1.2/1.3
// No SSL 2.0/3.0 support
// Strong cipher suites only

Learn More

• TLS protocol details
• SSL certificates
• HTTPS implementation
• Encryption basics