Home Books Training Newsletter Resources
Sign up Log in
book cover

Bulletproof TLS Guide  

Comprehensive and yet concise guide to practical SSL/TLS and PKI configuration. Includes coverage of TLS server configuration and web application security. Written by Ivan Ristić.


Bulletproof TLS Guide

Ivan Ristić

Version 2025.1 (build 143), published in May 2025.

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, without the prior permission in writing of the publisher.

The author and publisher have taken care in preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein.

Feisty Duck Limited
www.feistyduck.com
contact@feistyduck.com

Production editor: Jelena Girić-Ristić

Copyeditor: Melinda Rankin

Copyright © 2025 Feisty Duck Limited. All rights reserved.
Table of Contents
  • Preface
  • Chapter 1. Configuration Guide
    • 1.1 Private Keys and Certificates
      • 1.1.1 Use Strong Private Keys
      • 1.1.2 Secure Your Private Keys
      • 1.1.3 Choose the Right Certification Authority
      • 1.1.4 Prevent Certificate Warnings
      • 1.1.5 Restrict Key and Certificate Sharing
      • 1.1.6 Think Chains, Not Certificates
      • 1.1.7 Deploy Certification Authority Authorization
      • 1.1.8 Automate Certificate Renewal
      • 1.1.9 Consider Short-Lived Certificates
      • 1.1.10 Use Certificate Transparency Monitoring
    • 1.2 Configuration
      • 1.2.1 Use Secure Protocols
      • 1.2.2 Use Forward Secrecy
      • 1.2.3 Use a Strong Key Exchange
      • 1.2.4 Prioritize the Best Cipher Suites
      • 1.2.5 Use Secure Cipher Suites
      • 1.2.6 Ensure Ticket Keys Are Rotated
      • 1.2.7 Mitigate Known Problems
      • 1.2.8 Supporting Legacy Platforms
    • 1.3 HTTP and Application Security
      • 1.3.1 Encrypt Everything
      • 1.3.2 Secure Cookies
      • 1.3.3 Use Strict Transport Security
      • 1.3.4 Deploy Content Security Policy
      • 1.3.5 Disable Caching
      • 1.3.6 Be Aware of Issues with HTTP Compression
      • 1.3.7 Understand and Acknowledge Third-Party Trust
    • 1.4 Performance
      • 1.4.1 Don’t Use Too Much Security
      • 1.4.2 Enable Session Resumption
      • 1.4.3 Optimize Connection Management
      • 1.4.4 Enable Caching of Nonsensitive Content
      • 1.4.5 Use Fast Cryptographic Primitives
    • 1.5 Validate and Monitor
@feistyduck

Books

  • Bulletproof TLS and PKI
  • ModSecurity Handbook
  • OpenSSL Cookbook

Training

  • Practical TLS and PKI

Resources

  • Newsletter
  • SSL/TLS and PKI History
  • Archived Books
  • Bulletproof TLS Guide

Company

  • Support
  • Website Terms of Use
  • Terms and Conditions
  • Privacy Policy
  • About Us