Skip to main content

SSL Certs, Keys and Trusts

Recently faced some weird issues with ssl, while building a new infrastructure. So this will be a post on SSL basics which actually is sufficient to fix even crazy error  like "SSLHandshakeException". For guys wondering what is that, I too have no idea abt it. Its computer way of saying, go and read basics  before bugging me.
Browser based Handshakes(One way cert validation):
Say I open, browser sends a request to, will give me a certificate that will have hostname(gmail),  validity of certificate,  public key of and a hash to make sure data is not tampered. Browser uses the public key to encrypt data to gmail which can be decrypted only with gmail's private key. Similarly gmail sends data encrypted with its private key which can be decrypted with its public key which the browser has.
SSL Session:
 But everybody will have gmail's public key. What if any culprit decrypts data from gmail and reads it? So at the start of https connection a session is established, meaning once the server sends a cert, the client  creates its own key(mostly symmetric ones Read DSA,RSA) which is valid for this session. The client then sends this key encrypted with the public key of the server thereby preventing man in the middle
Fake Server:
Say you request for, if the DNS server is infected by a malware, it will redirect to some fake server, the fake server will be able to produce a cert impersonating as and keys. This will lead to loss of passwords or confidential info. To avoid this, a trusted third party called CA(Certificate Authority) comes into picture. There are lot of commercial CAs like verisign. The browser will have public keys of trusted CA. Gmail's cert will be signed with the private key of one of the trusted CAs. So if I request, gmail will send its cert signed with CA's private key. Now you open cert with CA's public key and then find gmail's public key. Its like double protection and the quality of protection depends on the reliability of CA. So that if you visit certain https site which dont use trusted CAs to sign their certificate, the browser would warn you.
Fake Client:
This case is not typically handled in our day to day activities. Whenever you visit, you are authenticated as a valid client by application logics like passwords/cookies, not by ssl layer.
But there might be a case like I run a set of clients who periodically gets configuration(set of tasks) from a server. In such a case, the clients will also get their cert signed by CA, once the server is authenticated , the client sends its cert with the public key of server, the server decrypts with its private key, then with CA's public key and then validates client.

Confused?? The diagram below should put things in place


Popular posts from this blog

How we have systematically improved the roads our packets travel to help data imports and exports flourish

This blog post is an account of how we have toiled over the years to improve the throughput of our interDC tunnels. I joined this company around 2012. We were scaling aggressively then. We quickly expanded to 4 DCs with a mixture of AWS and colocation. Our primary DC is connected to all these new DCs via IPSEC tunnels established from SRX. The SRX model we had, had an IPSEC throughput of 350Mbps. Around December 2015 we saturated the SRX. Buying SRX was an option on the table. Buying one with 2Gbps throughput would have cut the story short. The tech team didn't see it happening. I don't have an answer to the question, "Is it worth spending time in solving a problem if a solution is already available out of box?" This project helped us in improving our critical thinking and in experiencing the theoretical network fundamentals on live traffic, but also caused us quite a bit of fatigue due to management overhead. Cutting short the philosophy, lets jump to the story.

LXC and Host Crashes

 We had set up a bunch of lxc containers on two servers each with 16 core CPUs and 64 GB RAM(for reliability and loadbalancing). Both the servers are on same vlan. The servers need to have atleast one of their network interface in promiscuous mode so that it forwards all packets on vlan to the bridge( ) which takes care of the routing to containers. If the packets are not addressed to the containers, the bridge drops the packet. Having this setup, we moved all our platform maintenance services to these containers. They are fault tolerant as we used two host machines where each host machine has a replica of the containers on the other. The probability to crash for both the servers at the same time due to some hardware/software failure is less. But to my surprise both the servers are crashing exactly the same time with a mean life time 20 days. We had to wake up late nights(early mornings) to fix stuffs that gone down The

The server, me and the conversation

We were moving a project from AWS to our co-located DC. We have setup KVMs scheduled by Cloudstack for each of the component in the architecture. The KVMs used local storage. The VMs are provisioned with more than required resources because we have the opinion that in our DC scaling during peak load and then downscaling doesn't offer much benefits financially as we are anyways paying for the hardware in advance and its also powered on. Its going to be idle if not used. Now we found something interesting our latency in co-located DC was 2 times more than in AWS. The time for first byte at our load balancer in aws was 60ms average and at our DC was 112ms. We started our debugging mission, Mission Conquer-AWS. All the servers are newer Dell hardwares. So the initially intuition was virtualisation is causing the issue. Conversation with the Hypervisor We started with CPU optimisation, we started using the host-passthrough mode of CPU in libvirt so VMs dont see QEMU emulated CPUs,