hello explorers and welcome to another video today I'm gonna talk a little bit
about how to set up an a self certificate for your docker image so if
you have an environment where you build things locally and you want to use SSL
or TLS in order to get a secure environment so you can test specific
features for instance chrome will not turn on serviceworker if you not have
SSL enabled so if you want to try out specific features and you want to do
that locally you need to actually get SSL and trusted certificate to work
so and my one of my colleagues had some difficulty in getting this set up so I
thought it would be informative to actually make a video so you can take
what we found out together and run with it so you don't have to have this
problem that we had and we found a lot of people online also giving wrong or
misleading information so I hope that this will help you out when you are
trying to set this up so first off you have my little readme here where I have
all my commands so I will come back to this when I need to run different
commands and this will explain everything that you need to do so if you
find this repository later you can read up here and get what you need you can
also ask me questions if you like first off we need to create a root certificate
so this is for our root a certificate authority that needs a key so we will
need to set that up so first up we use open SSL to generate a key and open SSL
is available in most UNIX or Linux installations there are libreSSL as
well but I don't know how to use it so if you're using that instead you might
need another setup so here we generate our keys and we get an output to this
key here and it should be 2048 bit and then I create a request for this key
and putting nodes key and here we have our little key and then it should be
have message authentication of sha256 it should be valid for 1,024 days
so a long time and we also have this output of the actual key or the actual
certificate so this will create a certificate for us a root certificate
and that we will use later on to install in our browsers so let's go into you see
here we will create our root certificate start off and here we need to answer a
few questions what country are you from I'm from hot Sweden today and then we
need a state let's say disney land perhaps and city I live live near
Gothenburg so let's say that and I will have an organization my fluffy
stichery let's say that and an organization unit that's not applicable
common name server a common name or your name
well am Daniel let's put that in there email address is of course test at
example dot com and there we have my root certificate so now I have created that
certificate so let's go into our browser here and on the settings page in this
case I'm using Firefox but any browser will probably have this so if you go
into something like security and privacy and then you find this view certificates
or some way you find certificates in your browser and you usually have
something like root authorities or authorities or something like that and
here you can see everything that your browser trusts today so this is a long
and jarring list and if you find anything in here that you don't trust at
all you can actually remove it if you like and so this is to every site that
you do go to that have SSL if you if they are signed by any of these
authorities the browser will actually think think that they are trusted so if
you find authority here that you don't trust but now we want to add our own so
we go in here I have my github and my Apache project here and in my you see I
have my root certificate so add that in there and I get this little question
here I want to trust this certificate authority to identify websites I need to
check that box and then I'm done in the browser so we can go back to our little
editor here and next up we need to create our website certificate so if we
go in there look at this I have some things up here that actually checks that
I have supplied a subdomain for my little server I also need to check that
we actually created the root certificate and I also need to file the v3
extensions that I will come to later we can look at that and then I do some
setup here I add the domain and a common name then I put the common name into the
subject here so this is the certificate subject for our certificate so here we
have the country the state the organization I don't know what L stands
for hmm could that be the city hmm I don't know really it's not that
important you need to put the common name down here and the common name need to be
the server URL so that's why I actually take the common name that we get in and
put there and then I also need to replace the domain inside
of the v3 to the common name as well and I also have this secure conf
configuration this is a secure configuration for apache I also need to
change the domain variable there to our my common name and when we are going to
create our little key here first off create a request and that's the request
I usually send to a certificate authority to get signed but in our case
we will use our own so we will sign it later so first off we create this
request it's a new and we create a new key and it should be 2048 bits it
should be have a message authority message authentication code used by sha
256 we create notes again we have a key out so this is our server key here and
we put in the subject we talked about and then we put out our certificate
request so this is what we send to the actual certificate authority but as we
are the certificate authority we will sign this key here and this is the
actual standard for certificates so x.509 is the certificate standard and
this is telling us that we will create a new certificate here and we take a
request in and this is the server request that we got we say that we have
our rootCA our certificate here and we also have the key for that certificate
and then we create a serial number for this key from the CA and then we do an
output to a root certificate or our server certificate
the new one and it will be for 999 days so it's a long time for that as well and
we will use sha-256 for our our little site this is actually to check that we
actually have the same certificate so the 256 is the you you create a Mac so
that's a message authentication code and that is for the full certificate and
that is what you signed later on so this is how strong the actual binding of all
the data inside of your certificate will be and then we use this extension file
that we created earlier so let's look at that extension file and here we say that
we want an authority key identifier and we will identify by the key ID and issuer
so this is just to say what we'll identify our certificate we also say
that we have some constraints here that this is not a certificate authority and
that's important to tell to bake into a certificate or else you will get some
failures and then we will tell what key usage we will have this key we will use
it for digital signatures we will use it for nonRepudiation
keyEncipherment and dataEncipherment and keyEncipherment that's for the envelope
so if you have an SSL envelope with where you're going and so on and you
want to sign that you have keyEncipherment and if you want to encrypt your
data that's dataEncipherment and this nonRepudiation
I don't really know how to actually understand this I will read it from the
web page now where they tell about this and see if you can figure out what this
does use when a public key is used to verify digital signatures used to
provide a non repudiation service and non repudiation protects against the
signing entity false denying some action excluding certificate or CLR
signing I don't know but your certificate should have that capability
as well and then we put in some subject alt names and these are very important
for Chrome specifically because if you don't have a subject alt name that is
your domain DNS name for the your domain then Chrome will not allow that
certificate so this is something that is very important to get right and it took
us a long time to get this actually working and let's create our certificate
here so we create a domain certificate for my server local there it created my
little certificate so let's look at the configuration for my Apache server now
so here first off in my secure configuration I need to turn on SSL and
rewrite those are two things that are good to actually have in the image
I'm running at the moment my apache will not in the SSL module will not
support SSL compression but if your image does that then you want to turn
that off because there is actually Fault in the thought about how to use this so
if you using SSL compression you might have degraded security because there is
a man middle attack to this compression so you should not have that turned off
that might change in the future these things usually do and then you
want to honor the cipher order so this is for the cipher suite so I wanted to
check for these in order so the first if we can use that and if the server the
client has that capability I want to use that first and so on and and then I want
to have all the SSL protocols but I don't want to use as
a SSL version 2 because that is not that secure probably deprecated I don't
want to use SSL version three I don't think SSL version 1 even exists
anymore and I don't want to use TLS version 1 or TLS version 1.1 the
current one it's TLS version 1.2 and I think TLS version 1.3 is in the making
but TLS 1.2 is really old so this it should be fine everybody
should have it all browsers should support it so I wanted to turn off all
the old less secure versions of the TLS and then the cipher suit here it's a lot
of them because you want to support a older browsers as well but if you want
to read one of these then you first off have diffie hellman key exchange so this
is an elliptic curve diffie-hellman key exchange this is how you exchange keys
between each other and then you have the authentication so you actually check
that you are the right parties that is also elliptic curve DSA so that's the
key that you used to actually authenticate yourselves and then you use AES
256 with GCM so AES is an encryption algorithm and GCM is actually a
interesting addition that makes it possible for you to send unencrypted
data but still have it signed on the line so this is a very common encryption
algorithm to use for the data sending the data and then you use sha384
bytes for the message authentication code to validate that your message is
still is the same that the sender actually sent and then we just turn on strict
mode for this and we listen on 443 and then here you see what I changed the
domain name so this is to set the actual server name of my server and then I
create a virtual host so this is standard Apache configuration turn on
SSL I say where my keys are and then I set on strict Transport Security and
how long it should actually be valid and this is to say that this should always
run over TLS should never run over anything else and if you have ever found
a correct certificate then you should not be okay with going with a less
secure domain so if you find anything that goes over HTTP you should
automatically push it over to HTTPS and that's I want something that the browser
does yeah so that's that the last thing we want to look at is the docker image I
use an apache httpd Alpine docker image and Alpine is this of amazing little
docker image server that is actually only five Meg's so with the HTTP server
this is 70 Meg's so the large part is actually apache this case and then I
copy over my public directory here to the docs so I actually get my
index.html sent over so this is where you will put all your data if you are
creating a website I copy over the server keys I copy over this secure
configuration for apache and then I add this line to my apache HTTP
configuration that will include my secure configuration so it will actually
extend the apache configuration with my
configuration so let's go down here and we go back to my little readme and I do
docker build you might not need to do sudo I do for some reason in
my setup here because it doesn't really allow me to build images otherwise your
mileage may vary so that's how we build this it's quite fast to actually build
it now I really pulled down all the data as well I haven't built it before and
then just set it up and got it running and then we have this little phrase here
to run this as a daemon interactive and with a terminal but I haven't specified
any command so it will actually not turn it up and I put the name in here and I
want it to run on 8443 and 443 in the back end and my server image so
let's start that up but I need to go in and actually see here if I can find
slash there we have it I actually we need to go into my hosts
file as well and on localhost here I want to add my server dot local in order
for it to and I need to do sudo to do that let's see please get to edit here
my server local so it knows that my server local is actually this server
and not nothing else so we go back here we have my server local see if it
actually goes to the right place if we do 8443 here bad requests your
browser has sent the requested server could not understand your speaking a
plain HTTP for a SSL enabled well that's good information we need to put SSL as
well and we didn't now we have secure certificate tunnel here with which is
verified by my fluffy stitchery and so this is how you set up your own SSL
Certificates you how you create your root certificate
and then create your host certificate how you edit your apache configuration
in order to use your certificate and also which different
cipher suits you should use I haven't gone through them all but I have copy
pasted into this repo some cipher suits that are recommended today by SSL labs
and if you watch this in the future they might not be that secures you might need
to look at some new ones but it's a good thing to actually keep on touch on these
and update these not regularly but sometimes because security is a changing
field so what's secure today will not be secure tomorrow and I hope that you
found this video interesting I hope that you learned something today if you liked
this video give it a like share it with your friends and colleagues if you have
any comments or questions leave them in the comment section below and I really
hope to see you in the next video
Không có nhận xét nào:
Đăng nhận xét