TLS — Dos and Don’ts

1. Bodo Möller, Thai Duong, Krzysztof Kotowicz; This POODLE Bites: Exploting the SSL 3.0 Fallback; https://www.openssl.org/~bodo/ssl-poodle.pdf

2. Mozilla; Attacks on SSL and TLS, https://wiki.mozilla.org/Security/Server_Side_TLS#Attacks_on_SSL_and_TLS

3. Ivan Ristić; Bulletproof SSL and TLS

4. Ivan Ristić; OpenSSL Cookbook

5. Ivan Ristić; SSL/TLS Deployment Best Practices, https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices.pdf

6. Diverse Autoren; Applied Crypto Hardening, https://bettercrypto.org/static/applied-crypto-hardening.pdf

7. Chris Palmer; Gradually sunsetting SHA-1, http://googleonlinesecurity.blogspot.de/2014/09/gradually-sunsetting-sha-1.html

8. IANA TLS Cipher Suite Registry, http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4

9. BSI; Technische Richtlinie TR-02102-2, Kryptographische Verfahren: Empfehlungen und Schlüssellängen, Teil 2 — Verwendung von Transport Layer Security (TLS). https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSITR-02102-2_pdf.pdf?__blob=publicationFile

10. OWASP; Transport Layer Protection Cheat Sheet, https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet

11. OWASP; HTTP Strict Transport Security https://www.owasp.org/index.php/HTTP_Strict_Transport_Security

12. OWASP; Certificate and Public Key Pinning, https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

13. Mozilla Wiki — Security TLS, https://wiki.mozilla.org/Security/Server_Side_TLS

14. Certificate Transperency, http://www.certificate-transparency.org/

15. Let’s encrypt; https://letsencrypt.org/

16. Apache mod_ssl Dokumentation; http://httpd.apache.org/docs/2.4/mod/mod_ssl.html

17. ENISA; Algorithms, key size and parameters report 2014, http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-size-and-parameters-report-2014

18. Fox, Dirk: Perfect Forward Secrecy (PFS). DuD 11/2013, S. 729

    Article  Google Scholar 

19. Achim Hoffmann, Torsten Gigler; O-Saft — Richtig verschlüsseln mit SSL/TLS; OWASP Day Germany 2014, https://www.owasp.org/images/1/19/Richtig_verschluesseln_mit_SSL%2BTLS_-_Achim_Hoffmann%2BTorsten_Gigler.pdf

Download references