Bulletproof SSL and TLS
by Ivan Ristic · first published 2014
18mentions
10recommended by
13HN commenters
2014–2020first – last mentioned
77% recommend23% neutral
Why HN recommends it
Practical, thorough guide to SSL/TLS, PKI and secure server configuration, well suited to engineers who build, deploy or manage real TLS deployments and need reference material.
Summarised by Claude from recommending comments
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
If you are interested in details of the TLS protocol, check out these two books: - Implementing SSL / TLS Using Cryptography and PKI [1] - Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications [2] In the first one the author implements the protocol (RSA/DH) from scratch (without even using any crypto library).…
on “How HTTPS Handshake Happens” ↗I hear good things about Bulletproof SSL/TLS by Ivan Ristić: https://www.feistyduck.com/books/bulletproof-ssl-and-tls/ There was also a nice web page presenting all kinds of PKI concepts that I came across a few years ago but haven't been able to find since then. :-(
on “Ask HN: Want to study SSL, HTTPS, and the works. Where to start?” ↗This is one of the sections of Ristic's excellent book Bulletproof SSL and TLS. I owe him a review of it but the short version is it's great if you need to learn about SSL and TLS and great because it's entirely practical. Highly recommended.
on “Show HN: OpenSSL Cookbook 2nd Edition” ↗Ivan Ristic's "Bulletproof SSL and TLS"[0] [0] https://www.feistyduck.com/books/bulletproof-ssl-and-tls/rev...
on “HTTPS Interception Weakens TLS Security” ↗We love you Ivan! 'Bulletproof SSL and TLS' joins 'The Illustrated Network' and the 'Unix and Linux System Administration Handbook' as the 'if you're going to read one book' book for its topic. Which is a massive achievement. Random question…
on “SSL Labs in 2016 and Beyond” ↗Ivan, I bought your book "Bulletproof SSL and TLS". It's excellent, and I recommend it to those who are charged with building, deploying, or managing a real world deployment that includes TLS.
on “How HTTPS Handshake Happens” ↗Just to be clear, my books mentioned in the blog post (Bulletproof SSL and TLS and OpenSSL Cookbook) are most certainly not out of date. In fact, they are a rare example of books that are continuously maintained. I pledged to maintain them for as long as there are people interested…
on “Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection” ↗…harder. I've put considerable effort into a scalable architecture and self-monitoring. I wish Ivan the best of luck. On a related note if you want to learn about SSL/TLS I highly recommend Ivan's book "Bulletproof SSL and TLS". It is great. Snitch is already doing a few things SSL Labs isn't doing (supporting custom ports, and IMAPS) and over time the differences in our services will become more and more apparent. I'm very…
on “SSL Labs API Released” ↗I'm also a happy user of SSL Labs and reader of Bulletproof SSL and TLS. One very cool thing about the book is that if you purchase the hard copy (I got it from Amazon, for example), they'll email you epub, PDF, and web versions for free. The web version is perfect for reference…
on “SSL Labs in 2016 and Beyond” ↗…Labs (https://www.ssllabs.com/ssltest/) and discusses really interesting and useful topics on SSL/TLS configuration and management. You should also buy his awesome book: https://www.feistyduck.com/books/bulletproof-ssl-and-tls/ (no, I'm not affiliated with Ivan. I just think he is awesome and his content is hugely valuable). - https://www.imperialviolet.org/ Imperial Violet is the blog of Adam Langley (http://www.rsaconference.com/speakers/adam-langley),…
on “Ask HN: What programming blogs do you recommend to read regularly and why?” ↗This is just a symptom. The underlying problem is the whole model of the SSL PKI. To quote Ivan Ristic's Bulletproof SSL and TLS: > There’s an inherent flaw in how Public Key Infrastructure (PKI) operates today: any CA is able to issue certificates for any name without having to seek approval from the domain name owner. It seems…
on “Let's Encrypt: an automated certificate authority to encrypt the entire web” ↗…is verified you know that (1) you're talking to the right person and (2) that you have a secret (session keys) that you can use to efficiently protect the conversation. Disclosure: I am the author of Bulletproof SSL and TLS, already mentioned in another comment here. Feel free to ask me anything.
on “How HTTPS Handshake Happens” ↗Well, actually you can, but only as part of Bulletproof SSL and TLS. OpenSSL Cookbook is Bulletproof chapters 11 and 12, plus SSL/TLS Deployment Best Practices (another guide I wrote) in the appendix. Or, you can simply print it yourself. At 94 pages, it's easily doable.
on “Show HN: OpenSSL Cookbook 2nd Edition” ↗Where can I buy Bulletproof SSL and TLS?
on “Show HN: OpenSSL Cookbook 2nd Edition” ↗See https://www.feistyduck.com/books/bulletproof-ssl-and-tls/
on “Ask HN: What do you want to see in a manual for SSL/TLS/HTTPS?” ↗