Subject: Re: https without certificate

From: "Ralf S. Engelschall" <[email-masked]>
Date: Sun, 10 Feb 2002 18:15:34 +0100

In article <[email-masked]> you wrote:

> I was wondering if it may be possible to configure modssl to do crypto
> with no certificate.

No.

> I know that it should be possible because certificates are just a way to
> authenticate the server, not to establish the crypto.

No, the server certificate is also important and required for the secure
exchange of the crytography parameters of SSL/TLS. Without this, the
client and server would not be able to securely exchange the necessary
symmetric encryption parameters.
                                       Ralf S. Engelschall
                                       [email-masked]
                                       www.engelschall.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mathieu Arnold <[email-masked]>
Date: Mon, 11 Feb 2002 22:13:53 +0100

> > I was wondering if it may be possible to configure modssl to do crypto

too bad

> symmetric encryption parameters.

well, that's right, but, if I don't really care about that much security
and would just like some crippled http to get rid of young kiddies ?

-- 
Mathieu Arnold

---

From: Owen Boyle <[email-masked]>
Date: Tue, 12 Feb 2002 09:10:24 +0100

> and would just like some crippled http to get rid of young kiddies ?

Read Ralf's reply again - the certificate actually *contains* the
server's public key. The browser uses this to encrypt a session-key and
send this back to the server. Thereafter, the browser and server use
this common session key to communicate throughout the rest of the
session.

Without a certificate, the browser can *never* establish communication
with the server. It's like opening a locked door without a key. Read
some of the docs for more details.

If you don't care about authentication (or rather, if you believe your
clients don't care about authentication) then make a self-signed
certificate as described in the mod_ssl docs (see the website). This
will provide the free certificate you need to get SSL working.

Rgds,

Owen Boyle.

---

From: "R. DuFresne" <[email-masked]>
Date: Tue, 12 Feb 2002 09:00:48 -0500 (EST)

> and would just like some crippled http to get rid of young kiddies ?

<chuckle>  Well ya could always banner-up:

Warning, no one underage allowed!

<rofl>

Thanks,

Ron DuFresne
-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: "SoilentG" <[email-masked]>
Date: Tue, 12 Feb 2002 08:16:27 -0800

> will provide the free certificate you need to get SSL working.

When I first started messing with SSL I too had wanted this but found it
not possible.  However, if you do a self-signed certificate then you have
to send the public certificate to the users so they don't get that annoying
pop-up.  Otherwise you'll have to cough up some dough for a signed cert from
a true authority.  Sadly, in our wonderfully free Linux world, you hit a
brick wall where you either have to 1) live with an annoying feature, 2) use
a clumsy workaround or 3) pay, pay, pay.

Jeff