Preface      
        
Chapter 1. OpenSSL
        Getting Started
                Determine OpenSSL Version and Configuration
                Building OpenSSL
                Examine Available Commands
                Building a Trust Store
                
        Key and Certificate Management
                Key Generation
                Creating Certificate Signing Requests
                Creating CSRs from Existing Certificates
                Unattended CSR Generation
                Signing Your Own Certificates
                Creating Certificates Valid for Multiple Hostnames
                Examining Certificates
                Key and Certificate Conversion                
                
        Configuration
                Cipher suite selection
                Performance      
        	
        Creating a Private Certification Authority
                Features and Limitations
                Creating a Root CA
                Creating a Subordinate CA
                
Chapter 2. Testing with OpenSSL
        Connecting to SSL Services
        Testing Protocols that Upgrade to SSL
        Using Different Handshake Formats
        Extracting Remote Certificates
        Testing Protocol Support
        Testing Cipher Suite Support
        Testing Servers that Require SNI
        Testing Session Reuse
        Checking OCSP Revocation
        Testing Renegotiation
        Testing for the BEAST Vulnerability
        Testing for Heartbleed
        
Appendix A: SSL/TLS Deployment Best Practices
        Introduction
        
        1. Private Key and Certificate
                1.1. Use 2048-bit Private Keys
                1.2. Protect Private Keys
                1.3. Ensure Sufficient Hostname Coverage
                1.4. Obtain Certificates from a Reliable CA
                1.5. Use Strong Certificate Signature Algorithms
                
        2. Configuration
                2.1. Deploy with Valid Certificate Chains
                2.2. Use Secure Protocols
                2.3. Use Secure Cipher Suites
                2.4. Control Cipher Suite Selection
                2.5. Support Forward Secrecy
                2.6. Disable Client-Initiated Renegotiation
                2.7. Mitigate Known Problems
                
        3. Performance
                3.1. Do Not Use Too Much Security
                3.2. Ensure That Session Resumption Works Correctly
                3.3. Use Persistent Connections (HTTP)
                3.4. Enable Caching of Public Resources (HTTP)
                3.5. Use OCSP Stapling
                
        4. Application Design (HTTP)
                4.1. Encrypt 100% of Your Web Site
                4.2. Avoid Mixed Content
                4.3. Understand and Acknowledge Third-Party Trust
                4.4. Secure Cookies
                4.5. Deploy HTTP Strict Transport Security
                4.6. Disable Caching of Sensitive Content
                4.7. Ensure That There Are No Other Vulnerabilities
                
        5. Validation
        
        6. Advanced Topics