Unit 5: HTTPS and certificates · Lesson 3 of 5 · 18 min

Trust and HSTS

Trust the right authority, keep old protocols off and tell browsers to insist on HTTPS.

mission

You are
The analyst reviewing the shop's HTTPS site.
Situation
A developer's script fails with a certificate error, and their fix was to add -k. You need to show the right fix.
Goal
Reproduce the error, fix it with the internal CA and check what the server still accepts.
Hand in
The right curl command and a note on HSTS and old protocols.

Why the first visit matters

  1. First visit over HTTPSServer sends Strict-Transport-Security
  2. Browser remembersFor max-age seconds
  3. Later http:// linkBrowser upgrades it before sending
01

Reproduce the error

learner@web-lab
curl -sS https://shop.internal:8443/health 2>&1 | head -n 1
curl: (60) SSL certificate problem: unable to get local issuer certificate

you should see curl does not know the internal authority.

02

Trust the right authority

learner@web-lab
curl -s --cacert certs/shop-ca.crt https://shop.internal:8443/health
ok

you should see ok, with every check still on.

03

Watch the name check work

learner@web-lab
curl -sS --cacert certs/shop-ca.crt https://127.0.0.1:8443/ 2>&1 | head -n 1
curl: (60) SSL: no alternative certificate subject name matches target host name '127.0.0.1'

you should see The certificate is valid, but not for that name. That check is what -k would have thrown away.

04

Old protocols

learner@web-lab
openssl s_client -connect shop.internal:8443 -tls1_2 </dev/null 2>/dev/null | grep 'Cipher is'
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
openssl s_client -connect shop.internal:8443 -tls1_1 </dev/null 2>&1 | grep -m1 -o 'no protocols available'
no protocols available

you should see TLS 1.2 still works with a modern suite. For TLS 1.1, your own OpenSSL refuses before sending anything: the old versions are switched off on both sides of a modern setup.

05

HSTS

learner@web-lab
curl -sI --cacert certs/shop-ca.crt https://shop.internal:8443/ | grep -i strict
Strict-Transport-Security: max-age=300

you should see Five minutes. After that, a browser will happily try plain HTTP again.

defender tip Roll HSTS out in steps: a day, a week, then a year with includeSubDomains once every subdomain serves HTTPS.

Fixing a certificate error

Wrong
curl -k https://shop.internal:8443/

Turns off the identity check, the part that stops an attacker in the middle.

Right
curl --cacert certs/shop-ca.crt https://shop.internal:8443/

Trusts one more authority and keeps every check.

What a defender takes away

  1. 1Never fix certificate errors with -k or a click-through.
  2. 2TLS 1.2 and 1.3 only; 1.0 and 1.1 should fail.
  3. 3HSTS needs a max-age measured in months, not minutes.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.