Understanding SSL for Beginners

I propose understanding SSL by using a comparison with SSH. If you know one, you will easily understand the other.

A Comparison with SSH

If you’re already familiar with SSH, understanding SSL will be a breeze. Let’s break it down in an easy-to-read manner.

What is SSH?

SSH (Secure Shell) is a protocol used to securely access remote computers. It’s like having a secure tunnel through which you can manage your servers and transfer files without worrying about eavesdropping. Here’s a quick rundown of how SSH works:

1. Key Pair Generation: You generate a pair of cryptographic keys—one public and one private—typically on your local machine (the client).
2. Public Key Distribution: You place the public key on the remote server.
3. Authentication: When you connect to the server, it uses your private key to verify your identity. If they match, you’re granted access.

• Known Hosts File: SSH stores the public keys of previously connected servers in the known_hosts file, ensuring that you are connecting to the same trusted server each time.

Think of SSH as a secure way to open a door to a remote computer where only the right key can unlock the door. SSH typically uses port 22 for connections.

What is SSL?

SSL (Secure Sockets Layer), now commonly known as TLS (Transport Layer Security), is a protocol designed to secure communication between a web browser and a web server. It ensures that any data exchanged between the two remains private and integral. Here’s a simplified explanation of how SSL/TLS works:

1. Certificate Generation: A website generates a public and private key pair, similar to SSH.
2. Certificate Signing and Distribution:
   • Certificate Signing Request (CSR): The public key is included in a CSR and sent to a Certificate Authority (CA).
   • Verification by CA: The CA verifies the authenticity of the website and signs the certificate.
   • Distribution: The signed certificate is then installed on the web server.
3. Authentication and Encryption:
   • Connection Establishment: When a browser connects to a website, it retrieves the server’s SSL/TLS certificate.
   • Verification: The browser verifies this certificate against a list of trusted CAs.
   • Secure Connection: If it’s valid, the browser and server establish a secure, encrypted connection.

SSL/TLS typically uses port 443 for HTTPS connections.

Key Differences and Analogies

1. Third-Party Verification

   • SSH: The trust is established directly between you and the remote server using your own keys.
   • SSL/TLS: Involves a third-party (CA) to verify the server’s authenticity. This is like having a notary verify that a document is legitimate, adding an extra layer of trust.

2. Purpose

   • Both serve to secure data transmission between a local PC and a remote server, ensuring data privacy.
   • SSH is primarily used for remote command-line access and file transfers.
   • SSL/TLS is used for securing web traffic and other application-layer protocols.

3. Known Hosts File vs. Certificate Authorities

   • SSH Known Hosts: SSH uses the known_hosts file to store the public keys of previously connected servers. This file ensures that the server you are connecting to is the same trusted server from previous connections. In fact, it is a concept of working without third-party authorities.
   • SSL/TLS Certificate Authorities: In SSL/TLS, browsers and other clients maintain a list of trusted Certificate Authorities (CAs). When a server presents an SSL/TLS certificate, the client verifies it against this list. The CA acts as a trusted third party that vouches for the server’s identity, similar to how the known_hosts file ensures server identity in SSH.

4. Encryption Process

   • Both SSH and SSL/TLS use a combination of asymmetric and symmetric encryption:
     • Asymmetric encryption (public-key cryptography) is used for the initial key exchange.
     • Once the connection is established, they switch to faster symmetric encryption for the actual data transfer.

5. Certificate Types and Management

   • SSH typically uses user-generated keys.
   • SSL/TLS can use CA-signed certificates (recommended for public websites) or self-signed certificates (suitable for testing or internal use).
   • SSL/TLS includes mechanisms for certificate revocation if a certificate is compromised, which is not a standard feature in SSH.

6. Protocol Evolution

   • While we often still use the term SSL, it’s important to note that SSL is technically deprecated. Modern systems use TLS, which is the successor to SSL and provides improved security.

SSH: A Practical Example

Let’s walk through a practical example of setting up and using SSH keys:

1.Generating SSH Keys:
To create a new SSH key pair, use the following command:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/my_key

This command will generate a 4096-bit RSA key pair:

A private key: ~/.ssh/my_key
A public key: ~/.ssh/my_key.pub

2.Placing the Public Key on the Remote Host:
To add your public key to the remote server, you can use this command:

cat ~/.ssh/my_key.pub | ssh [email protected] "cat >> ~/.ssh/authorized_keys"

This command copies your public key to the authorized_keys file on the remote server.

1. Connecting Using the Private Key:
   To connect to the remote server using your private key, use:

ssh [email protected] -i /home/alex/.ssh/my_key

Enabling Password-less Login:
To login without entering a password each time, ensure that the SSH daemon on the remote server is configured to allow public key authentication. Check the /etc/ssh/sshd_config file for these settings:

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

If you make any changes to this file, restart the SSH service:

sudo systemctl restart ssh

By following these steps, you can set up secure, key-based authentication for your SSH connections, enhancing both security and convenience.
Remember to keep your private key secure and never share it. The public key is the one you distribute to servers you want to access.

SSL/TLS: A Practical Example (Self-Signing Case)

While self-signed certificates are not recommended for public-facing websites, they can be useful for development or internal use. Here’s how to create and use a self-signed SSL/TLS certificate:

1. Generating a Private Key and Certificate Signing Request (CSR):
   First, create a private key and a CSR:

openssl req -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr

This command will:

Generate a 2048-bit RSA private key: domain.key
Create a Certificate Signing Request: domain.csr
Prompt you to enter information about your organization

1. Creating a Self-Signed Certificate:
   Use the CSR to create a self-signed certificate:

openssl x509 -signkey domain.key -in domain.csr -req -days 365 -out domain.crt

This creates a self-signed certificate (domain.crt) valid for 365 days.

1. Configuring a Web Server (e.g., Nginx):
   Edit your Nginx configuration file (often found at /etc/nginx/sites-available/default) to use the certificate:

server { listen 443 ssl; server_name yourdomain.com; ssl_certificate /path/to/domain.crt; ssl_certificate_key /path/to/domain.key; # ... other server block contents ...
}

1. Restarting the Web Server:
   After configuring, restart Nginx:

sudo systemctl restart nginx

1. Testing the Connection:
   You can test the SSL/TLS connection using OpenSSL:

openssl s_client -connect yourdomain.com:443

This will show detailed information about the SSL/TLS handshake and the certificate.

1. Browser Warning:
   When accessing your site via HTTPS, browsers will show a warning about the certificate not being trusted. This is normal for self-signed certificates.
2. Adding a Security Exception:
   To bypass the browser warning during development, you can add a security exception in your browser for this specific certificate.

Remember, self-signed certificates are suitable for testing and development but not for production environments accessible to the public. For public-facing websites, always use certificates signed by a trusted Certificate Authority.
By following these steps, you can set up a basic SSL/TLS encryption for your web server using a self-signed certificate. This process demonstrates the core concepts of SSL/TLS certificate creation and usage, albeit in a simplified manner compared to using a trusted CA.

By understanding these similarities and differences, you can gain a clearer picture of how both SSH and SSL/TLS work to secure your digital communications.