Re: Using the SSL module.

On 22 Jun 2015 03:56, "Chris Angelico" <[email protected]> wrote:
>
> On Mon, Jun 22, 2015 at 6:11 AM, Trilok Tourani
> <[email protected]> wrote:
> > Thanks a lot Chris. Can you also please elaborate when the server is
built
> > with pike, in my case, it is the localhost(127.0.0.1).
> > and also, does SSL.context() generate its own random keys for us?
>
> Let's keep this on the list - I'm not the greatest expert on all this,
> and I'd rather have the chance that someone else might catch my
> errors!
>
> From what I understand, yes, the SSL module will generate all the
> session keys and things. But it doesn't generate keys or certificates.
> You have two basic options: Firstly, go through the usual commercial
> signing route - search the web for SSL certificates, pick a nice cheap
> one, go with that. Or alternatively, create a self-signed certificate
> (again, search the web; you'll find instructions for doing that on
> various platforms), and then have a copy of the certificate embedded
> in the client. The latter is more secure if you control both ends,
> plus it doesn't cost money.

Note that it's reasonably simple to generate self-signed certificates in
Pike; take a look at SSL.https for an example.

> Commercial certs are great if you want to
> work with the broader internet, particularly web browsers.
>
> Once you have those generated, all you need to do is parse them
> (they're conventionally stored in an ASCII format, base-64 encoded
> with some framing) and hand them on to the SSL port. It's been a while
> since I did that, but I could probably dig up some example code to
> show you.

/grubba