Presentation at WordCamp Chicago 2017 by Jessica Gardner

1. SSL:
What it is, How to do it, &
Why you should care
WordCamp Chicago 2017

2. Hello!
A bit about me…
@jessicacgardner

3. 1.
SSL: What it is

4. HTTP Review

6. HTTPS

7. The 3 main things
◎Authentication and Verification
◎Privacy/Data Encryption
◎Data Integrity

8. Jargon & Acronyms
◎SSL – Secure Socket Layer
◎TLS – Transport Layer Security
◎HTTPS – Hypertext Transfer Protocol Secure
◎PKI – Public Key Infrastructure
◎CA – Certificate Authority
◎CSR – Certificate Signing Request

9. Image: https://thenocman.com/ssl-certificates/

11. Image: https://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication

12. 2.
Why you should care

13. Who Needs It?
◎E-Commerce– PCI Compliance
◎Entertainment- DRM
◎Market Research
◎Productivity
◎Social Media
◎Education/Testing
◎Sensitive Form Data

17. 3.
How to do it

18. You’ll Need…

19. Certificate contents
◎Domain name (common name)
◎Public key
◎Owner of certificate (subject)
◎Issuer of certificate (CA)
◎Expiration data
◎Serial number

20. Types of Certificates
◎Domain Validation – CA checks right of
applicant to use domain name
◎Organization Validation – CA does above +
vets organization
◎Extended Validation – CA does above +
thorough vetting of organization

21. Self-Signed vs Trusted CA
◎Self-Signed: generally used for testing.
Offers encryption but not validation. Will give
errors.

22. Trusted Certificate Authorities
◎Client (browser) checks certificate validity
◎OCSP request (Online Certificate Status
Protocol)
◎CRL – Certificate Revocation List
○If revoked, client returns error
○If clear, communications proceed

26. Let’s Encrypt (Yes, Let’s!)
◎Free, automated, open certificate
◎Non-profit Internet Security Research Group
◎Domain validation
◎No warranty
◎3-month expiry

27. ◎Update Site URL from http:// to https://
◎Force http requests to https

28. Issues and Caveats
◎Moving a site
◎Cloud Proxy
◎Mixed/Unsecure content

29. Removing SSL
◎wp-config.php
◎.htaccess
◎Updating site URL (functions.php)

32. Thanks!
Any questions?
You can find me at:
@jessicacgardner
jessica@btwrx.com

33. Resources
◎SSL Server Test:
https://www.ssllabs.com/ssltest/
◎Why No Padlock?
https://www.whynopadlock.com/
◎CryptoReport
https://cryptoreport.websecurity.symantec.com/
checker/