1. PKI 2: Protezione del traffico Web tramite SSL Fabrizio Grossi

2. Overview  Introduction to SSL Security  Enabling SSL on a Web Server  Implementing Certificate-based Authentication

3. Introduction to SSL Security  Why Use SSL to Secure Web Traffic?  Multimedia: Using SSL to Secure Web Traffic  Certificates Used for an SSL Session  Guidelines for Choosing a Private or Commercial CA

4. Why Use SSL to Secure Web Traffic? By default, HTTP packets are transmitted as plaintext Implement SSL to: Encrypt the transmitted data at the application layer Enable Web clients to authenticate the Web server By default, HTTP packets are transmitted as plaintext Implement SSL to: Encrypt the transmitted data at the application layer Enable Web clients to authenticate the Web server

5. Using SSL to Secure Web Traffic Web Client Internet Web Server HTTP

6. Certificates Used for an SSL Session Certificate typeUsagePurpose Server certificates Mandatory  Secure transmission of the session key  Authenticate the Web server User certificates Optional  Authenticate the user  Implement certificate-based authentication of Web users

7. Guidelines for Choosing a Private or Commercial CA Business requirement Private CA Commercial CA Increase user confidence in your Web site Minimize the configuration of internal computers Include liability insurance Enforce your organization’s security policy Give end users flexibility for managing certificates Reduce the costs of issuing certificates

8. Enabling SSL on a Web Server  How to Acquire a Web Server Certificate from a Private CA  How to Acquire a Web Server Certificate from a Commercial CA  SSL Configuration Options  Certificate Deployment for Complex Configurations  Guidelines for Enabling SSL Security

9. Implementing Certificate-based Authentication  Web-based Authentication Methods  Types of Certificate Mapping  How to Implement Certificate Mapping in IIS  How to Implement Certificate Mapping in Active Directory  Guidelines for Certificate Mapping

10. Web-based Authentication Methods Authentication method Authentication security Anonymous authentication N/A Basic authentication * Digest authentication **.NET Passport *** Integrated Windows authentication **** Basic authentication with SSL **** Client certificates ***** * = low; ***** = high

11. Types of Certificate Mapping Mapping typeDescriptionUse when One to one A single certificate maps to one user account Each user must be uniquely identified Many to one Multiple certificates map to one user account based on common attributes Multiple users require the same level of access