Gentle introduction to TLS, PKI, and Python's ssl module

TLS/SSL is the most important and widely-used protocol for secure and encrypted communication. I’m going to introduce you to TLS 1.2 and 1.3, cryptographic building blocks, best-practice configuration, certificates, and public key infrastructure using Python’s ssl module

TLS is an ubiquitous protocol for secure communication. It’s used in HTTPS, email (IMAP, POP3, SMTP), LDAP, FTP, and more. Some recent protocols like HTTP/2 are not defined for unencrypted channels. TLS offers more than just encryption with symmetric cryptography. It also ensures data integrity and strong authentication with the help of X.509 certificates and public key infrastructure (PKI).

Did you ever wonder what’s the difference between SSL, TLS, and StartTLS? Or what is the meaning of cryptic terms and names like Server Name Indication, Subject Alternative Name, OCSP or TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384? What is perfect forward secrecy and why is it so important for privacy? Does HTTPS make my website slow? What is the difference between a root CA, intermediate CA and end-entity certificate? The talk will give you answer these questions. It covers a quick introduction to the cryptographic building blocks, the TLS handshake, cipher suites, structure of certificates and what is going to change with TLS 1.3. You’ll also learn best practices for TLS configuration and how to use Python’s ssl module.

Some prior knowledge of cryptography and networking basics are helpful but not required to follow this talk.

In the Python community I’m know as maintainer of CPython’s ssl and hashlib module as well as contributor to Python security team. In my professional life I work as a security engineer in the areas of identity management (FreeIPA IdM, Dogtag PKI) and container security at Red Hat. I have given similar talks about security in the past. You can find a selection of my presentations on speakerdeck, https://speakerdeck.com/tiran/ .