SSL/TLS and Public Key Infrastructure

Trace the historical evolution of ssl/tls from netscape's 1995 ssl to tls 1.3, noting deprecation of ssl 2.0 and improvements in confidentiality, authentication, integrity, and cipher suites.

Identify five freely available tools for certificate management and packet analysis—Java keytool, OpenSSL, Apache httpd, Apache Tomcat, and Wireshark protocol analyzer—and download them for upcoming lessons.

Download and install the latest java development kit (jdk) from Oracle, create an Oracle account to download, select Windows 64-bit, verify with java -version, and set up the environment variable.

Install Apache Tomcat to demonstrate SSL concepts and run a local web server on port 8080 by downloading the package, locating the bin directory, and starting the server.

Locate the Java keytool in the JDK, learn to generate key pairs and manage certificates by importing, exporting, and printing certificates in keystore and truststore, using OpenSSL as needed.

Explore how to download, install, and verify the OpenSSL utility on Windows and Linux, and use its commands to inspect certificates, ciphers, and TLS connections.

Learn to download, install, and run Keystore Explorer, a Java-based GUI for keystores and certificate management, and configure the Java runtime by setting JAVA_HOME.

Install Wireshark, the network protocol analyzer, via Windows Installer to capture and inspect SSL/TLS traffic. Filter for SSL packets, view the client hello handshake, and explore TLSv1.2 communications.

Explore the CIA triad (AIC triad)—confidentiality, integrity, and availability—and how access controls, data in transit protection, and reliable hardware sustain secure information ecosystems.

Learn the difference between encoding and encryption, and how encoding enables cross-system data transfer using public schemes like ASCII, Unicode, URL encoding, and base64, without hiding content.

Encryption converts plain text into coded data using an algorithm and a key to keep information confidential. It requires the algorithm and the key to decrypt, distinguishing it from encoding.

compare symmetric and asymmetric encryption to reveal how keys enable confidentiality. explain how public and private keys reduce key distribution risks and enable decryption without sharing keys.

Demonstrate encrypting and decrypting data with a symmetric algorithm, specifically aes, using the command prompt. Observe plain text, encrypted file file.enc, and successful decryption back to plaintext.

Explore asymmetric encryption with openssl by generating RSA private and public keys, encrypting plaintext with the private key, and decrypting with the public key.

Generate RSA private and public keys, encrypt text with the public key, and decrypt with the private key to demonstrate how public and private keys secure data.

Explore the concept of a cipher as a repeatable algorithm, from simple substitute ciphers like the Caesar cipher to the role of keys for decryption and cipher strength.

Explore how a digital certificate proves a website’s identity by linking its public key to the domain, establishing trust similar to a passport.

Learn how a digital signature uses a digital certificate to hash a message, encrypt the hash with a private key, and enable verification with a public key for non-repudiation.

Understand cipher suites as bundles of key exchange, bulk encryption, and message authentication codes in ssl/tls, with examples like aes 256 or aes 128.

Explore hashing as a key information security technique that ensures data integrity by producing a unique hash for messages or files using md5, sha1, sha256, or sha512 with OpenSSL.

Explore how salt adds randomness to passwords to create unique hashes per user, protecting against database compromises. Learn why salts must be truly random to avoid duplicates.

Keystore stores your own keys and certificates, protected by a password, while truststore stores trusted certificates to verify other systems and enable secure communication.

Explore how the SSL handshake negotiates protocol versions and cipher suites via client hello and server hello, exchanges certificates, and supports optional client authentication before a secure key exchange.

Understand how the client hello initiates the TLS handshake on first connection or renegotiation, conveying protocol version, random data, cipher suites, compression methods, and extensions.

Learn how the server responds to a client hello with a server hello, negotiating a cipher suite and extensions to advance the handshake.

During the TLS handshake, the server presents its X.509 certificate and chain to prove identity; mutual authentication may require a client certificate, while server certificates are mandatory.

Explore the server key exchange step in TLS, how the master secret secures subsequent packets, and why the finished message hashes all handshake messages for authentication.

During the finished message, the handshake completes and the connection is encrypted; it includes a hash of every handshake message using a MAC algorithm for authentication.

Explore how SSL and TLS fit the OSI seven-layer model and the debate over their placement between the application and session layers.

This lecture explains that a hello retry request happens when client hello lacks information in handshake, triggering the server to request missing data and the client to resend a hello.

Explore public infrastructure (PKI) and how it binds public keys to identities through digital certificates, registration authorities, and automated or supervised certificate issuance, renewal, and revocation.

Explore how a certificate authority issues and signs digital certificates, validates requester identity, and manages validity, expiration, and revocation lists for public key infrastructure.

the registration authority offloads certificate requests from the certificate authority by validating the requester’s identity and address, handling key generation if needed, and managing certificate lifecycle tasks.

Learn how a certificate repository centralizes digital certificates and public keys for a PKI, ensuring reliable, fast access to active and revoked certificates via LDAP, organized by organization.

Explain the roles of the relying party and the subscriber in PKI, showing how trusted certificates from an issuer enable secure e-commerce with examples like Amazon and GlobalSign.

Learn common digital certificate file formats, including PKCS#12 for private keys, X.509 certificates, certificate signing requests, and PKCS#7 for certificate bundles, plus how certificate authorities shape certificate chains.

Explore the certificate lifecycle from a certificate signing request (CSR) and validation by the registration authority under the certification authority to expiry and revocation tracked in the location list.

Explore the chain of trust in PKI, detailing entity, intermediate, and root certificates, how path-building and certificate path validation verify trust, and why root CAs stay offline.

Explore one-way ssl authentication, where the server presents its certificate and the client validates it against a trusted root store to verify identity, unlike mutual authentication.

Learn about mutual authentication ssl (two-way ssl) where both client and server present certificates. See how server-side configuration, such as Tomcat, enforces client certificate requests and strengthens security.

Secure a tomcat web application by generating a self-signed certificate, creating a keystore, and configuring tomcat for one-way ssl authentication, then test with https.

Enable mutual authentication in tomcat by setting the connector's clientAuth to true, restart the server, and require a client certificate when accessing the site.

Learn to create certificates using the Keystore Explorer graphical interface. Generate self-signed certificates or certificate signing requests, protect the keystore with a password, and manage keys, aliases, and certificate details.

Explore private key generation and management, and compare DSA, RSA, and elliptic-curve options, noting how key size, algorithms, and compatibility affect security and performance.

Learn to manage private keys securely by keeping them private, generating keys offline on an offline computer, protecting them with a strong password, and rotating them after incidents.

Choose the right cipher suite to secure client server communications, using ephemeral keys per connection to prevent attackers from decrypting packets with the private key. Consider interoperability and performance.

Examine the TLS 1.2 protocol architecture, focusing on the record and handshake protocols and their headers. Learn how change cipher spec and alerts drive negotiation to symmetric encryption.

Describe how the record protocol provides a basic transport with handshake, change cipher spec, and application data types, plus encryption, integrity, compression, and optional DNS extensions to enhance SSL capabilities.

the lecture explains the change cipher spec (ccs) subprotocol, a single encrypted message signaling transition during a connection once enough data for key generation is exchanged.

Explore the SSL/TLS alert subprotocol, signaling handshake and message errors with alert levels and codes; use close_notify for graceful shutdown and fatal alerts to terminate the session, aiding debugging.

Set up a root CA by creating a directory structure, initializing the certificate database and serial, generating an AES-256 RSA key pair, and issuing an X.509 root certificate with v3_ca.

Explore the OpenSSL configuration file and its defaults, focusing on the ca default, request parameter, and policy sections, and how directories, serial numbers, private keys, and revocation lists shape certificates.

Set up an intermediate CA within a root PKI, create directories and files, generate and sign a certificate signing request with the root CA so the intermediate can issue certificates.

Create a client certificate signed by the intermediate certification authority by generating a private key, producing a CSR, and signing it with the intermediate certification authority using the server_cert extension.

Generate a root certificate and key pair with KeyStore Explorer, then create a CSR for a client. Sign the CSR with the root and import the signed certificate.