1

I have found it very hard to find any books or articles that assume no understanding and take you from nothing to a master at managing SSL certificates on web servers.

Most articles I have found deal with specific implementation on particular machines or stop after a very basic overview.

Are there any that are heralded as must reads for someone wanting to know more?

|improve this question
  • 1
    Which specific aspect of managing certificates for SSL are you interested in? Is it more about how certificates work in general or perhaps some best practices (in terms of system administration)? Is it a wider question in terms of how to set up an HTTPS website properly? – Bruno Aug 1 '12 at 18:06
  • Good point. I would have imagined there would be some books or articles that would cover all things SSL (including HTTPS). – Toby Aug 1 '12 at 21:19
0

You might want to take a look at my book, "Implementing SSL/TLS Using Cryptography and PKI" (I'm not sure what the rule on linking is here, but if you just paste the title into an Amazon search, it will come up). It's extremely detailed; it's targeted at programmers who are actually implementing SSL (and includes a completely worked out implementation in C, crypto, certificate parsing, and all).

You might also want to read over: http://commandlinefanatic.com/cgi-bin/showarticle.cgi?article=art012 It's shorter than the book (obviously), but I find that the details of exactly how digital signatures work within certificates is a big help in diagnosing problems.

|improve this answer
  • 1
    Here's a FAQ on self-promotion webmasters.stackexchange.com/faq#promotion I don't think Toby was interested in learning the cryptography algorithms and how PKI works. More along the lines of what SSL's are, how to generate them, how to install them self signed certs, what's the difference between SSL types etc. – Anagio Jan 5 '13 at 5:33
  • @Anagio: He has followed all of the guidelines on good-faith self-promotion. He's disclosed that he's the author, and he also linked to a free online article for additional information. Plus, understanding how PKI works is vital for SSL management. At the very least, his book is more helpful than the slideshare link you provided, which contains little useful information, or even the SANS whitepaper for beginners. And it's certainly more on-topic than the TLS 1.0 exploit you linked to (which is no longer relevant and doesn't provide any insights for SSL management). – Lèse majesté Mar 23 '13 at 6:39
0

This is a pretty good slideshare on what SSL is by GlobalSign http://www.slideshare.net/GlobalSign/beginners-guide-to-ssl-v10

Sans has SSL and TLS: A Beginners Guide which also includes diagrams of networks to show how SSL's handshake works between computers http://www.sans.org/reading_room/whitepapers/protocols/ssl-tls-beginners-guide_1029

I don't think you'll find an all in one book that covers the basics and goes into details. But after reading these beginner articles you may want to look into last years SSL hack

http://www.huffingtonpost.com/2011/09/20/hackers-break-ssl-encrypt_n_971510.html

A lot of articles discuss how the SSL servers were affected and how that in turn affected browsers

|improve this answer
0

In addition to Wikipedia, the MDN also has a few good introductions to SSL, as the Mozilla foundation sponsors NSS and an assortment of other PKI projects.

If you're looking for an all around SSL/TLS book, SSL and TLS: Designing and Building Secure Systems would be a good choice, as it discusses the workings of SSL, its strengths and limitations, as well as safe design patterns for implementing SSL across a variety of applications, including web servers and email clients.

You can also check out the Open-Source PKI Book, which is a free open source book on the various open source PKI implementations.

The problem with a book on SSL management is that SSL is used for so many different purposes and with so many different applications. How you set up or manage SSL certificates for web servers depends on what web server, OS and other PKI software you're using.

A lot of CAs and vendors (IBM, Symantec, Trustwave, Microsoft, etc.) have whitepapers and tutorials on certificate lifecycle management for large organizations, but they're usually tied to the specific certificate/PKI management product they're selling.

I suggest getting a basic understanding of how SSL works (how asymmetric encryption works, what is SSL/TLS designed to protect against, the architecture of PKI), then from there narrow it down to the specific application and usage scenario you're interested in and what solutions are available for it. Then you can just study the manuals and tutorials about those specific products, like:

And you'll have a much easier time finding detailed information from beginner to advanced.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.