Ivan Ristic - Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications

You are about to undertake a journey into the mysterious world of cryptography. Ive just completed minewriting this bookand its been an amazing experience. Although Id been a user of SSL since its beginnings, I developed a deep interest in it around 2004, when I started to work on my first book, Apache Security. About five years later, in 2009, I was looking for something new to do; I decided to spend more time on SSL, and Ive been focusing on it ever since. The result is this book.

My main reason to go back to SSL was the thought that I could improve things. I saw an important technology hampered by a lack of tools and documentation. Cryptography is a fascinating subject: its a field in which when you know more, you actually know less. Or, in other words, the more you know, the more you discover how much you dont know. I cant count how many times Ive had the experience of reaching a new level of understanding of a complex topic only to have yet another layer of complexity open up to me; thats what makes the subject amazing.

I spent about two years writing this book. At first, I thought Id be able to spread the effort so that I wouldnt have to dedicate my life to it, but that wouldnt work. At some point, I realized that things are changing so quickly that I constantly need to go back and rewrite the finished chapters. Towards the end, about six months ago, I started to spend every spare moment writing to keep up.

I wrote this book to save you time. I spent the large part of the last five years learning everything I could about SSL/TLS and PKI, and I knew that only a few can afford to do the same. I thought that if I put the most important parts of what I know into a book others might be able to achieve a similar level of understanding in a fraction of the timeand here we are.

This book has the word bulletproof in the title, but that doesnt mean that TLS is unbreakable. It does mean that if you follow the advice from this book youll be able to get the most out of TLS and deploy it as securely as anyone else in the world. Its not always going to be easyespecially with web applicationsbut if you persist, youll have better security than 99.99% of servers out there. In fact, even with little effort, you can actually have better security than 99% of the servers on the Internet.

Broadly speaking, there are two paths you can take to read this book. One is to take it easy and start from the beginning. If you have time, this is going to be the more enjoyable approach. But if you want answers quickly, jump straight to chapters 8 and 9. Theyre going to tell you everything you need to know about deploying secure servers while achieving good performance. After that, use chapters 1 through 7 as a reference and chapters 10 through 16 for practical advice as needed.