基于SSL证书认证中间件的安全性分析

安全套接字层SSL证书认证具有信任链验证、主机验证、证书撤销及证书扩展机制。定义了抽象化SSL协议栈内部SSL库的使用,扩展了用于连接的缺省值设置方法,阐述了信任链验证的OpenSSL应用程序接口具有不同有效主机名组成限制及证书列表匹配要求。在分析OpenSSL内部数据结构及数据运输层建立HTTPS连接机制的基础之上,揭示了JSSE不执行自身主机验证建立SSL连接的缺陷,并提出通过形式验证技术和编程来实现自动检查应用程序是否正确使用SSL库的关键选项与参数的解决策略。

Security Analysis of Middleware Based on SSL Certificate Authentication

Secure Socket Layer（SSL） certificate authentication has the trust chain,host authentication,certificate revocation and extension mechanism. The use of SSL library in the abstract SSL protocol stack is defined,and the setting method of default value used to connection is expanded. Then,it expounds that the trust chain validation OpenSSL application interfaces have different valid hostname composition limit and matching requirements of certificate list. Based on the analysis of HTTPS connection mechanism built by OpenSSL internal data structure and data transport layer,the defect that JSSE does not perform its host authentication to build SSL connection is revealed,and then the solving strategy that realize automatic check whether the application is correct to use key options and parameters of SSL library by formal verification techniques and programming,is put forward.