Published inLevel Up Coding·Apr 20Your Own Button for Sign-In with GoogleA way to implement using the OpenID Connect APIs that is just as simple as using the GIS library — Most web applications require identity management irrespective of whether they are customer facing or internal. To simplify the experience for users, integrating with an Identity Provider (IdP) like Google is common. It allows users to login with their existing Google account. This can be done using the Google Identity Services…Web Development6 min readWeb Development6 min read
Published inDev Genius·Sep 20, 2021RHEL/CentOS 7 Fix for Let’s Encrypt ChangeTake action before September 30, 2021 to avoid problems — TL;DR — For TLS certificates issued by Let’s Encrypt, the root certificate (DST Root CA X3) in the default chain expires on September 30, 2021. Due to their unique approach, the expired certificate will continue to be part of the certificate chain till 2024. This affects OpenSSL 1.0.2k …Centos5 min readCentos5 min read
Published inDev Genius·Aug 17, 2021TLS Explained — Issuer Authorization, Certificate Transparency, DANE, CAAAuthenticity of TLS certificate issued by a Public CA is no longer sufficient — In TLS — Transport Layer Security, the client establishes a connection with the server and negotiates a TLS session to ensure confidentiality of the communication. However, this confidentiality is not guaranteed if the server is not verified. While one may decide to use TLS to ensure the connection is encrypted…Cybersecurity6 min readCybersecurity6 min read
Published inDev Genius·Jun 8, 2021Let’s Encrypt change affects OpenSSL 1.0.x and CentOS 7Default certificate chain to include an expired root certificate — Let’s Encrypt is a Certificate Authority run by Internet Security Research Group (ISRG) that provides free and automated TLS certificates for secure communication over the Internet. …Lets Encrypt7 min readLets Encrypt7 min read
Published inDev Genius·Apr 30, 2021Added Security Measures and Changes in TLS 1.3A look at the newer version of TLS protocol and updates to its predecessor — When a new version of software is released, it could be to patch security vulnerabilities, fix bugs, provide new features and enhancements. Similarly, every few years newer versions of protocols are released. These newer versions largely retain the same goals but incorporate new requirements and challenges. Some protocols such as…Cybersecurity5 min readCybersecurity5 min read
Published inGeek Culture·Mar 29, 2021Exploring Application Layer Protocol Negotiation (ALPN)A simple TLS extension to support different applications on a single port — The Internet protocol suite which forms the basis for modern Internet allows for different services to be provided by a single host. These services are assigned a port number and any connection to the port is assumed to be for that service. …Cybersecurity5 min readCybersecurity5 min read
Published inGeek Culture·Mar 4, 2021Negotiation of TLS Parameters for HTTPS EncryptionInformation that is leaked and efforts to secure them — Browsing the web was originally insecure allowing eavesdroppers to see exactly what the user was doing. This is no longer possible due to the use of Transport Layer Security (TLS) underneath to encrypt all of the web traffic. …Cybersecurity5 min readCybersecurity5 min read
Published inDev Genius·Dec 28, 2020Well-Known Locations: A Reserved URI Path PrefixIts use in domain validation and email security — Did you know ? Well-Known URIs are those that begin with /.well-known/ in its path, and are of the format /.well-known/<suffix>. It is defined by RFC 8615. They are used in discovery of information, policies and domain validation, among other things. The proposed standard reserves the use of path prefix…Web4 min readWeb4 min read
Published inLevel Up Coding·Nov 30, 2020Multiplex TLS Traffic with SNI RoutingNginx configuration and HTTP/2 coalescing — Server Name Indication or SNI is a TLS extension originally designed for a single web server to serve multiple HTTPS sites configured with different TLS certificates. For example, when www.example.com uses TLS Certificate-A and www.example.net …Nginx4 min readNginx4 min read
Published inDev Genius·Nov 17, 2020Approach to Hardening Web ServersAttack surface reduction at a system level — Publicly accessible web servers receive requests from both legitimate and malicious users. It is important to recognize them both and take appropriate actions to process only those requests that should be processed, and serve only those content that should be served. In simpler terms, there are two distinct types of…Cybersecurity4 min readCybersecurity4 min read
