📘
Deuterium Wiki
  • Hello
  • Linux
    • cmd
      • du: 显式文件大小
      • seq: 生成序列
      • cat: 连接
      • cp: 复制
      • cd: 切换目录
      • mv: 移动
    • awk
      • 执行awk脚本
      • 删除空行
      • 个数统计
      • 文件的交集
      • 文件的差集
    • mysql
      • 删除重复数据
      • 导出数据不带标题
  • Reading
    • Novel
      • 《基督山伯爵》人物关系
    • Awesome CS Books
      • csapp-3e-homework-solution
        • 1. A Tour of Computer Systems
        • 2. Representing and Manipulating Information
          • 2.55 Compile and Run
          • 2.56 Another Try
          • 2.57 More show Procedures
          • 2.58 Check Little-Endian
          • 2.59 Bit Expressions
          • 2.60 Replace Byte
          • 2.61 More Bit Expressions
          • 2.62 Check Arithmetic Right Shift
          • 2.63 Logic & Arithmetic Right Shift
          • 2.64 Any Odd One
          • 2.65 Odd Ones
          • 2.66 Leftmost One
          • 2.67 Int Size is 32
          • 2.68 Lower One Mask
          • 2.69 Rotate Left
          • 2.70 Fits Bits
          • 2.71 Xbyte
          • 2.72 Copy Int
          • 2.73 Saturating Add
          • 2.74 Sub OK
          • 2.75 Unsigned High Prod
          • 2.76 calloc
          • 2.77 Multiple By Shifts
          • 2.78 Divide Power 2
          • 2.79 Mul3div4
          • 2.80 Three Fourths
          • 2.81 Generate Bits
          • 2.82 Signed and Unsigned
          • 2.83 Binary Floating Value
          • 2.84 Float Le
          • 2.85 Floating Point I
          • 2.86 Extend Precision
          • 2.87 Floating-Point II
          • 2.88 Floating-Point III
          • 2.89 Floating-Point IV
          • 2.90 fpwr2
          • 2.91 π
          • 2.92 Float Negate
          • 2.93 Float Absval
          • 2.94 Float Twice
          • 2.95 Float Half
          • 2.96 Float f2i
          • 2.97 Float i2f
        • 3. Machine-Level Representation of Programs
          • 3.58 Decode
          • 3.59 128-bit Multiply
          • 3.60 For Loop
          • 3.61 Conditional Data Transfer
          • 3.62 Switch I
          • 3.63 Switch II
          • 3.64 Multiple Dimension Array I
          • 3.65 Multiple Dimension Array II
          • 3.66 Multiple Dimension Array III
          • 3.67 Caller and Callee
          • 3.68 Alignment
          • 3.69 Struct
          • 3.70 Union
          • 3.71 fgets
          • 3.72 Variable-Size Stack
          • 3.73 Find Range I
          • 3.74 Find Range II
          • 3.75 Complex
      • tcpv1
        • ch01: Introduction
        • ch02: Link Layer
        • ch03: Internet Protocol
        • ch04: Address Resolutin Protocol
        • ch05: Reverse Address Resolution Protocol
        • ch06: Internet Control Message Protocol
        • ch07: Ping Program
        • ch08: Traceroute Program
        • ch09: IP Routing
        • ch10: Dynamic Routing Protocols
        • ch11: User Datagram Protocol
        • ch12: Broadcasting and Multicasting
        • ch13: Internet Group Management Protocol
        • ch14: The Domain Name System
        • ch15: Trivial File Transfer Protocol
        • ch16: Boostrap Protocol
        • ch17: Transmission Control Protocol
        • ch18: TCP Connection Establishment and Termination
        • ch 19: TCP Interactive Data Flow
        • ch20: TCP Bulk Data Flow
      • http
        • ch01: Overview of HTTP
        • ch02: URLs and Resources
        • ch03: HTTP Messages
        • ch04: Connection Management
        • ch05: Web Servers
        • ch06: Proxies
        • ch07: Caching
        • ch08: Integration Points
        • ch09: Web Robots
        • ch10: HTTP-NG
        • ch11: Client Identification and Cookies
        • ch12: Basic Authentication
        • ch13: Digest Authentication
        • ch14: Secure HTTP
        • ch15: Entities and Encodings
        • ch16: Internationalizated
        • ch17: Content Negotiation and Transcoding
        • ch18: Web Hosting
        • ch19: Publishing Systems
        • ch20: Redirections and Load Balancing
        • ch21: Logging and Usage Tracking
    • 提升认知
      • 《为什么需要生物学思维》
      • 《大话西方艺术史》
  • Mathematics
Powered by GitBook
On this page
  • 1. Making HTTP Safe
  • 1.1 HTTPS
  • 2. HTTPS: The Details
  • 2.1 HTTPS Schemes
  • 2.2 Secure Transport Setup
  • 2.3 SSL Handshake
  • 2.4 Server Certificates
  • 2.5 Site Certificate Validation
  • 3. Tunneling Secure Traffic Through Proxies

Was this helpful?

  1. Reading
  2. Awesome CS Books
  3. http

ch14: Secure HTTP

Previousch13: Digest AuthenticationNextch15: Entities and Encodings

Last updated 4 years ago

Was this helpful?

14.安全HTTP

1. Making HTTP Safe

We need a technology for HTTP security that provides:

  • Server authentication (clients know they're talking to the real server, not a phony)

  • Client authentication (servers know they're talking to the real user, not a phony)

  • Integrity (clients and servers are safe from their data being changed)

  • Encryption (clients and servers talk privately without fear of eavesdropping)

  • Efficiency (an algorithm fast enough for inexpensive clients and servers to use)

  • Ubiquity (protocols are supported by virtually all clients and servers)

  • Administrative scalability (instant secure communication for anyone, anywhere)

  • Adaptability (supports the best known security methods of the day)

  • Social viability (meets the cultural and political needs of the society)

1.1 HTTPS

2. HTTPS: The Details

2.1 HTTPS Schemes

2.2 Secure Transport Setup

2.3 SSL Handshake

2.4 Server Certificates

The server certificate is an X.509 v3derived certificate.

2.5 Site Certificate Validation

The steps are:

2.5.1 Date check

The browser checks the certificate's start and end dates to ensure the certificate is still valid.

2.5.2 Signer trust check

Every certificate is signed by some certificate authority (CA).

Browsers ship with a list of signing authorities that are trusted.

If a browser receives a certificate signed by some unknown authority, the browser usually displays a warning.

2.5.3 Signature check

The browser check the certificate's integrity by applying the signing authority's public key to the signature and comparing it to the checksum.

2.5.4 Site identity check

To prevent a server from copying someone else's certificate or intercepting their traffic, most browsers try to verify that the domain name in the certificate matches the domain name of the server they takled to.

3. Tunneling Secure Traffic Through Proxies

Once the client starts encrypting the data to the server, using the server's public key, the proxy no longer has the ability to read the HTTP header. And it won't know where to forward the request.

Use HTTPS tunneling protocol.

The client first tells the proxy the secure host and port to which it wants to connect.

And the client can transfer SSL data.