SSL Labs launches

Recently I've found myself spending more and more time not only thinking about SSL, but also working on several SSL-related projects. SSL is a remarkable technology that is not given nearly as much credit as it deserves. I think this is at least partially because SSL is so commonplace today that people take it for granted. Compared to other security technologies, it is also reasonably easy to configure. But therein lies the danger: SSL is so easy to use that most people have stopped thinking about SSL.

I think there's a large gap between how SSL is used today and how it should be used. Actually, I think we first need to make an effort to understand how SSL is actually used today in order to build on that knowledge. With that, in mind, I decided to start a new web site and use it as a launching point for my SSL-related projects. Fast-forward several months; today, I am happy to announce SSL Labs, which has just launched.

My initial work on HTTP client fingerprinting using SSL handshake analysis is already there (I will write more about it in subsequent posts), but I have several other projects, which I will publish in the following weeks.

Comments

[Christian Folini]

Hey Ivan,

Good luck with your new project! I like the client fingerprinting via SSL idea, I also like the module you provide. But would you mind adding ten lines of documentation, how one can actually log the said information?

Regards,

Christian

[Christian Folini]

This comment was not very clear. I meant, could you explain the fingerprint gathered, or how do I read it?

Sorry for the confusion.

[Ivan Ristić]

Hi Christian,

Yes, you are right: I forgot to describe the tokens that make up fingerprint values. I have corrected that now -- if you download the most recent version of the module from the repository you will find the explanation inside. I have also included a complete list of cipher suites to make it easer to decipher the fingerprint meaning (no pun intended ;).

[Wayne Price]

From my viewpoint, the biggest problem with SSL/TLS is that it is a peer-to-peer technology. It is fine for a client to connect to a server, but it needs an easy to use proxy capability to pass identity information across multiple layers, as with chains of Web Services.