Transport Layer Security
According to Wikipedia:
- Transport Layer Security (TLS), and its now-deprecated predecessor, Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network. Several versions of the protocols find widespread use in applications such as web browsing, email, instant messaging, and voice over IP (VoIP). Websites can use TLS to secure all communications between their servers and web browsers.
There are five TLS implementations available in the official repositories. OpenSSL should already be installed on your system as it is an indirect dependency of the meta package ( > > ). GnuTLS might already be installed on your system as it is required by many packages.
- OpenSSL — A robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols; also a general-purpose cryptography library.
- GnuTLS — A free software implementation of the TLS, SSL and DTLS protocols. Offers APIs for X.509, PKCS #12, OpenPGP and other structures.
- Network Security Services (NSS) — Implementation of cryptographic libraries supporting TLS/SSL and S/MIME. Also supports TLS acceleration and smart cards.
- mbed TLS — Portable SSL/TLS implementation, aka PolarSSL.
- LibreSSL — A version of the TLS/crypto stack forked from OpenSSL in 2014 by the OpenBSD project, with goals of modernizing the codebase and improving security.
With TLS one of a set of certificate authorities (CAs) signs for the authenticity of a public key certificate from a server. A client system connecting to the server via TLS may verify its certificate's authenticity by relying on a CA certificate obtained via a separate path. On Arch Linux the certificate authorities are provided by the package, which is most likely already installed because of the dependency chain (pacman > > ), and has the following dependency tree (excerpt):
Is just an anchor point, other packages depend on.
See Security#Managing SSL certificates on how to blacklist a certificate authority.
# trust anchor certificate.crt
This is for example required to allow a HTTPS MITM proxy to intercept traffic.
Obtaining a certificate
The first step is to generate an RSA private key. Before generating the key, set a restrictive file mode creation mask with umask (for example
/etc/ssl/privatedirectory like most other distributions do, see FS#43059.
A certificate can be obtained either from a certificate authority with a Certificate Signing Request (CSR) or self-signed. While self-signed certificates can be generated easily, clients will reject them by default, meaning that every client needs to be configured to trust the self-signed certificate.
For the actual generation commands refer to the article of the used implementation:
Because there are various attacks against TLS the best practices should be considered:
- Disable SSLv3 to prevent the POODLE attack.
- weakdh.org's Guide to Deploying Diffie-Hellman for TLS
- Mozilla's Server Side TLS article
- SSL Labs' SSL and TLS Deployment Best Practices
- Cipherli.st[dead link 2020-04-03 ⓘ]
Programs to check TLS:
Websites to check TLS:
- https://dev.ssllabs.com/ssltest/ (only HTTPS)
- https://www.checktls.com/ (only email)
- https://www.immuniweb.com/ssl/ (any port)
- https://tls.imirhil.fr/tls (any port)
See also List of ACME clients.
- acme-client — Secure Let's Encrypt client, written in C.
- acme-tiny — A 200-line Python script to issue and renew TLS certs from Let's Encrypt.
- acme.sh — A pure Unix shell script ACME client.
- acmetool — An easy-to-use ACME CLI, written in Go.
- https://github.com/hlandau/acme || AUR, AUR
- Certbot — ACME client recommended by Let's Encrypt, written in Python.
- dehydrated — ACME client, written in Bash.
- getssl — ACME client, written in Bash.
- https://github.com/srvrco/getssl || AUR, AUR
- lego — Lets Encrypt client and ACME library, written in Go.
- letsencrypt-cli — Yet another Letsencrypt (ACME) client using Ruby.
- manuale — A fully manual Let's Encrypt client, written in Python.
- ruby-acme-client — A Ruby client for the letsencrypt's ACME protocol.
- simp_le — Simple Let's Encrypt client, written in Python.
See alsoby GnuTLS and by OpenSSL.
Enable cryptography kernel module
Linux kernel includes cryptography kernel modules, but it may disable by default, this will slow down the TLS performance. Use
/etc/modules-load.d/ directory to load cryptography module from
/lib/modules/$(uname -r)/kernel/crypto and
/lib/modules/$(uname -r)/kernel/arch/x86/crypto, for example:
chacha20poly1305 chacha_generic ecc ecdh_generic nhpoly1305 poly1305_generic chacha-x86_64 poly1305-x86_64 aesni-intel ghash-clmulni-intel sha1-ssse3 sha256-ssse3 sha512-ssse3 nhpoly1305-sse2