HashiTLS Demystifying Security Certs

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

HashiTLS
Demystifying Security Certs
HashiTalks 2020
Alan Scherger
Cloud Janitor

Microsoft Teams - 3hr Outage
Feb 3, 2020

Nomad - CVE-2020-7956
Jan 28th, 2020

Kubernetes - CVE-2016-7075
Oct 10, 2016

So what?
1. Managing certiﬁcates in 2020 is still hard.
2. We keep repeating the same errors in our software.
3. It all st...

bit.ly/learn-mtls-the-hard-way
A future workshop that will be much more in-depth than these slides.

Agenda
Hands-on Practice
Use practical tools like mkcert
and HashiCorp Consul to get
familiar with how certiﬁcates
can be ...

SSL Certificate
TLS Certificate
HTTPS Certificate
X.509 v3 Certificate

SSL Certificate
TLS Certificate
HTTPS Certificate
X.509 v3 Certificate

X.509 v3 Certiﬁcate
RFC 5280

Certiﬁcate Basic Fields - 1/3
▪ Version Number
– The version of the encoded certiﬁcate.
▪ Serial Number
– A positive integ...

Certificate Basic Fields - 2/3
▪ Issuer
– Identifies the entity that has signed and issued the certificate.
▪ Validity
– The ...

Certiﬁcate Basic Fields - 3/3
▪ Subject Public Key Info
– Used to carry the public key and identify the algorithm with whi...

Let’s Look at a Certiﬁcate
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/rootCA.pem -text -noout
Certificate:
Data:
Ve...

TERMINAL
> openssl version
LibreSSL 2.8.3
>macOS
Catalina
10.15.3
LibreSSL since 10.13 -
September 2017

TERMINAL
> docker run --rm ubuntu:18.04 /bin/bash -c "apt-get
update && apt-get install openssl -y && openssl
version"
…
G...

OpenSSL Command
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/rootCA.pem -text -noout
This is the command which is use...

OpenSSL Command
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/rootCA.pem -text -noout
This specifies the input filenam...

OpenSSL Command
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/rootCA.pem -text -noout
-text : Prints out the certifica...

Version
The version of the encoded certiﬁcate.
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/rootCA.pem -text -noout
C...

Serial Number
A positive integer unique to the Certiﬁcate Authority.
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/roo...

Signature Algorithm
Contains the identiﬁer for the cryptographic algorithm used by the CA to sign this certiﬁcate.
TERMINA...

Issuer
Identiﬁes the entity that has signed and issued the certiﬁcate.
TERMINAL
> openssl x509 -in ~/.local/share/mkcert/r...

Validity
The time interval during which the CA warrants that it will maintain information about the status of the certiﬁca...

Subject
Identiﬁes the entity associate with the public key stored in the subject public key ﬁeld.
TERMINAL
Subject: O = mk...

Subject Public Key Info
Used to carry the public key and identify the algorithm with which the key is used.
TERMINAL
Subje...

Extensions: Key Usage
Deﬁnes the purpose of the key contained in the certiﬁcate.
TERMINAL
Subject: O = mkcert development ...

Extensions: Basic Constraints
Identiﬁes whether the subject of the certiﬁcate is a CA and
the maximum depth of valid certi...

Extensions: Subject Key Identiﬁer
Provides a means of identifying certiﬁcates that contain a particular public key.
TERMIN...

Blue Book
Volume VIII - Fascicle VIII.8
Data Communication Networks Directory
Recommendations X.500-X.521
🔥 236 glorious p...

Certiﬁcate Authority
Is an entity that issues digital certiﬁcates.

Certificate Chain of Trust
A list of certificates (usually starting with an end-entity
certificate) followed by one or more C...

Cryptographic Protocols
The ﬁnal chapter in me rambling!

Cryptographic Protocols
Protocol Document Deprecated
SSL Version 2.0 Draft
March 2011
RFC 6176
SSL Version 3.0 RFC 6101
Ju...

Hands-on Practice

FiloSottile/mkcert
A simple tool for making locally-trusted development certificates.

iOS 13 and macOS 10.15 - Gotchya
https://support.apple.com/en-us/HT210176

iOS 13 and macOS 10.15 - Gotchya
https://support.apple.com/en-us/HT210176

Install
Download the latest
Release
Use the -install ﬂag to
generate an install
certiﬁcates.
TERMINAL
> chmod +x ~/Downloa...

TERMINAL
> ls -al /Users/ascherger/Library/Application Support/mkcert
total 16
drwxr-xr-x 4 ascherger staff 128 Feb 16 22:...

Inspect the
Root CA
Private Key
RFC 3447
Section 3.2
TERMINAL
> openssl rsa -in rootCA-key.pem -text -noout
Private-Key: (...

TERMINAL
> openssl x509 -in rootCA.pem -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
84:4a:83:84:72:ad:2...

Make a new
localhost
certiﬁcate.
TERMINAL
> mkcert localhost 127.0.0.1 ::1
Using the local CA at
"/Users/ascherger/Library...

Serial Number
Remember “18:f1” we’ll see that again soon.
TERMINAL
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
18:f...

Issuer
Matches our Root CA public key information.
TERMINAL
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
18:f1:88:4e...

Validity
Patched to get around the macOS hiccup.
TERMINAL
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
18:f1:88:4e:1...

Subject
No Common Name (CN), and diﬀerent than CA information.
TERMINAL
Certificate:
Data:
Version: 3 (0x2)
Serial Number:...

Key Usage
Explicitly allows for Web Server usage, but not Client usage.
TERMINAL
Subject Public Key Info:
Public Key Algor...

Basic Constraints
This certiﬁcate cannot act as a CA, so it cannot make child certiﬁcates.
TERMINAL
Subject Public Key Inf...

Authority Key Identifier
Matches the Subject Key Identifier of the Root certificate.
TERMINAL
X509v3 Authority Key Identifier...

Subject Alternative Name
A list of DNS and IP addresses this certiﬁcate is allowed to represent.
TERMINAL
X509v3 Authority...

$Nginx default.conf CODE EDITOR server { listen [::]:443 ssl http2 ipv6only=on; listen 443 ssl http2; server_name localhost...$

Run Nginx
TERMINAL
> docker run -p 4448:443 -v "`pwd`:/etc/nginx/conf.d" nginx
Unable to find image 'nginx:latest' locally...

Visit https://localhost:4448/
The certiﬁcate is trusted, and the Serial Number matches the certiﬁcate we just created.

cloudﬂare/cfssl
Cloudflare’s PKI and TLS toolkit

bit.ly/consul-mtls
Learn mTLS with Consul!

Consul + TLS
1. Consul CLI has a tls command for setting up a CA and certiﬁcates.
2. Consul has an auto_encrypt feature fo...

bit.ly/vault-learn
Learn how to setup Vault!
Be sure to look up tls_require_and_verify_client_cert

bit.ly/nomad-mtls
Learn mTLS with Nomad!

Learn the Code

Consul - Encryption
If verify_server_hostname is set, then outgoing
connections perform hostname veriﬁcation.
All servers ...

package tlsutil - config.go L706-L726
CODE EDITOR
// Wrap a net.Conn into a client tls connection, performing any
// addit...

Nomad - Securing With TLS
To fulﬁll the desired security properties Nomad
certiﬁcates are signed with their region and rol...

package tls - common.go L510-L521
CODE EDITOR
// VerifyPeerCertificate, if not nil, is called after normal
// certificate ...

package nomad - server.go L451-L477
CODE EDITOR
// getTLSConf gets the server's TLS configuration based on the config supp...

package nomad - server.go L479-L497
CODE EDITOR
// implements signature of tls.Config.VerifyPeerCertificate which is calle...

package nomad - server.go L499-L515
CODE EDITOR
func validateRPCRegionPeer (name, region string) bool {
parts := strings.S...

Thank You!
Alan Scherger
@ﬂyinprogrammer
bit.ly/learn-mtls-the-hard-way
73

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1052471 views
Storytelling For The Web: Integrate... by Chiara Aliotta 967761 views
Artificial Intelligence, Data and C... by OECD Directorate ... 900577 views
How to Leverage AI to Boost Employe... by SocialHRCamp 380598 views
2024 State of Marketing Report – by... by Marius Sescu 215763 views
Everything You Need To Know About C... by Expeed Software 233752 views

View on Slideshare

1 of 73 Ad

View on Slideshare

1 of 73 Ad