{"id":9,"date":"2007-01-15T21:58:27","date_gmt":"2007-01-15T21:58:27","guid":{"rendered":"http:\/\/patchlog.com\/security\/tls-for-http\/"},"modified":"2007-01-15T22:12:20","modified_gmt":"2007-01-15T22:12:20","slug":"tls-for-http","status":"publish","type":"post","link":"https:\/\/patchlog.com\/security\/tls-for-http\/","title":{"rendered":"TLS for HTTP"},"content":{"rendered":"<p>On my previous post about wildcard ssl I was complaining that you have to use a different ip for each domain that needs ssl\/https and I wondered why there is no TLS feature like there is in SMTPS where you have STARTTLS. Well it seems I was wrong. There is such a feature, actually there are two different features one is described in <a target=\"_blank\" title=\"rfc2817 Upgrading to TLS Within HTTP\/1.1\" href=\"http:\/\/www.ietf.org\/rfc\/rfc2817.txt\">RFC2817<\/a> and the other in RFC3546.  Rfc 2817 specifies how a plain text connection can be \"upgraded\" to a secured connection over SSL:<\/p>\n<blockquote><p>This allows unsecured and secured HTTP traffic to share the same well known port (in this case, http: at 80 rather than https: at 443). It also enables \"virtual hosting\", so a single HTTP + TLS server can disambiguate traffic intended for several hostnames at a single IP address<\/p><\/blockquote>\n<p>RFC 3546 various extensions to TLS and one of them is an extension for <a title=\"Server name Indication\" target=\"_blank\" href=\"http:\/\/rfc.net\/rfc3546.html#s3.1\">server name indication<\/a> . This extension will allow a client to tell the server which domain is contacting.<br \/>\nThat's just great, but there's one problem. Not only that  few web server software implement any of the two rfcs  but also few web browsers support them.<\/p>\n<p>Apache implements rfc 2817 in mod_ssl since version 2.1 and  mod_gnutls implements  the server name indication extension in TLS described in rfc 3546.<br \/>\nIt seems that <a title=\"IE& support for rfc 3546\" href=\"http:\/\/blogs.msdn.com\/ie\/archive\/2006\/04\/17\/577702.aspx\">IE7<\/a> has support for RFC 3546 and firefox may have <a title=\"firefox support for rfc 2817\" href=\"http:\/\/wiki.mozilla.org\/Firefox\/Feature_Brainstorming:Security\">support for rfc 2817<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On my previous post about wildcard ssl I was complaining that you have to use a different ip for each domain that needs ssl\/https and I wondered why there is no TLS feature like there is in SMTPS where you have STARTTLS. Well it seems I was wrong. There is such a feature, actually there &hellip; <a href=\"https:\/\/patchlog.com\/security\/tls-for-http\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">TLS for HTTP<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[5],"tags":[354,363],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-security","tag-security","tag-web"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pofPh-9","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":0,"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"wp:attachment":[{"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patchlog.com\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}