有关 SSL 和 HTTPS 的好文章值得一读吗？
我在 iPhone 程序中接受无效的 SSL 证书时遇到问题。这个问题现在已经解决了，但是我开始明白，我对整个事情到底是如何工作有非常抽象的想法：
- 网络浏览器如何验证收到的证书是否真正用于它通信的主机，而不是被中间的同一方伪造？
- 浏览器是否与某个第三方（CA？）对话来进行证书检查？
和许多其他问题... 有人可以推荐良好的信息源，并对所有部件如何组合在一起进行足够深入的描述吗？
I had a problem with accepting invalid SSL certificate in my iPhone program. That problem is solved now, however I came to understanding that I have very abstract idea on how exactly the whole thing is working:
- how web browser is verifying that received certificate is really for host it communicates to and not faked by same party in the middle?
- if browser talks to some 3rd party (CA?) to do certificate check?
and many other questions...
Would someone please recommend good source of information with in-depth enough description of how all parts click together?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
这里有大量详细信息：https 连接的前几毫秒
关于该主题的权威书籍：SSL 和 TLS：设计和构建安全系统
Plenty of detail here: The First Few Milliseconds of an https Connection
And the definitive book on the subject: SSL and TLS: Designing and Building Secure Systems
查看此处的文章，特别是“SSL 简介”和“构建客户端-服务器环境的用户身份验证系统。”
Check the articles here, specifically "Introduction to SSL" and "Building user authentication systems for client-server environments."
网络欺骗重温：SSL 及其他
Web Spoofing Revisited: SSL and Beyond
这是 BlakHat 关于现代 SSL 攻击的精彩演讲：
http://www.thoughtcrime.org/software/sslstrip/
Chrome 最近为 https 引入了“严格传输安全”，部分解决了 Moxie Marlen Spikes 攻击。
This is an excellent BlakHat talk on modern attacks against SSL:
http://www.thoughtcrime.org/software/sslstrip/
Chrome recently introduced "Strict Transport Security" for https which partially addresses Moxie Marlen Spikes attacks.