抓包分析SSL/TLS连接建立过程

た入场券 2023-02-15 03:58 32阅读 0赞

![format_png][]

点击上方蓝字，关注我们

![format_png 1][]

**![format_png 2][]**

##  ##

1、前言

如今全站https的趋势越来越强烈，互联网对安全的认识越来越深入。本文根据自己的实际情况，对SSL链接建立做个总结。SSL相关的非对称加密和加密，涉及到公钥、私钥、证书、对称密钥，这些非常复杂，本文不会涉及。本文重点介绍SSL的握手过程，客户端和服务端的步骤，通过wireshark抓包分析整个过程。

##  ##

2、基本概念

SSL：（Secure Socket Layer，安全套接字层），位于可靠的面向连接的网络层协议和应用层协议之间的一种协议层。SSL通过互相认证、使用数字签名确保完整性、使用加密确保私密性，以实现客户端和服务器之间的安全通讯。该协议由两层组成：SSL记录协议和SSL握手协议。

TLS：(Transport Layer Security，传输层安全协议)，用于两个应用程序之间提供保密性和数据完整性。该协议由两层组成：TLS记录协议和TLS握手协议。

TLS是在SSL的基础上标准化的产物，目前SSL3.0与TLS1.0保持一致的，二者是并列关系，只是大家习惯称呼SSL。注明的web服务nginx默认支持的就是TLS1.0、TLS1.1、TLS1.2协议。调用的openssl库中，对应的就是ssl3\_acceptt函数。

SSL/TLS位于传输层和应用层之间，应用层数据不再直接传递给传输层，而是传递给SSL层，SSL层对从应用层收到的数据进行加密，并增加自己的SSL头。

![format_png 3][]

##  ##

3、握手过程

我使用nginx搭建了一个https的服务，nginx的默认ssl cipher为HIGH:!aNULL:!MD5; 不同的cipher 决定了握手的交互过程。chrome浏览器支持的cipher如下所示：

cipher的格式为：认证算法\_密钥交换算法\_加密算法\_ 摘要算法

![format_png 4][]

首先看看最基本的基于RSA的密钥协商算法，配置的ssl sipher为 AES256-GCM-SHA256。

![format_png 5][]

使用wireshark抓包分析，抓包如下所示：

![format_png 6][]

从上面报文可以看出，SSL建立过程如下图所示：

![format_png 7][]

使用椭圆曲线（ECDHE）算法作为密钥交换算法，配置ssl ciper为：![format_png 8][]，交互流程如下所示：

![format_png 9][]

抓包看如下：

![format_png 10][]

从上面报文可以看出，SSL建立过程如下图所示：

![format_png 11][]

相比RSA算法而言，握手过程多了一个server key exchange步骤

![format_png 12][]

RSA算法服务端没有Server key Exchange。

![format_png 13][]

**4、参考资料**

http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html

https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/

![format_png 14][]

[MySQL执行计划解析][MySQL]

[三个方案解决Elasticsearch深度翻页问题][Elasticsearch]

[大型系统的发布部署方案（图文）][Link 1]

[分布式系统中Redis为什么那么重要？][Redis]

[彻底搞清分库分表（垂直分库，垂直分表，水平分库，水平分表）][Link 2]

[小白也能学会的RAID磁盘冗余阵列教程][RAID]

![format_png 15][]

欢迎分享转发，有帮助的话点个“在看”

![format_png 16][]

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X2dpZi9VUzEwR2NkMHRRSER0ZTZaelhpY2xyWVVUQ1FIaWFrMGszcEtyS2ZPdW9JY2FzYVNLV2JLaWFpYnozRE55UHZVSk9yYXdodHV1aDZ2cm1oOE1XemNoZ04xSWcvNjQw?x-oss-process=image/format,png
[format_png 1]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X2dpZi9jNmdxbWhXaWFmeW9LSGU4OWliMlBrZ0Q2eXJSUXpOUnc0MVhHUHVMUHljT095UW5maWE0QkZ5b1QybTVsSVpZZThhOUV1ZEgzQ2RvYllDcjFpYUFEWHZKakEvNjQw?x-oss-process=image/format,png
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X2pwZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1WWxMVWVkQjFZMzk3TWN4SWhOZEI3R0tpYVhxNEtFRHJkWkhWWndLSGhaTHdIbXBMZ25NN0Rmdy82NDA?x-oss-process=image/format,png
[format_png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1SDFXZUcweVIzY0ppY2VYZ3Y3QmZLSzRKUDJvUmdEejFNRHdnNVNtcEtLSGZORWljNlFaZEZpYXN3LzY0MA?x-oss-process=image/format,png
[format_png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1WndYS3JzaWJUYmJrSU1iY01pY2syNUMyc2F0RkhhT0xmeXQ5ZFpjQnRNc09mVEVpYUFONGtsM0Z3LzY0MA?x-oss-process=image/format,png
[format_png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1MWo1U1lhdVQ3QzhrTHkxbHM3MUxTUUJRSlBndkNTV3lpYW5MQjFkNDhMUWxpY2pqb0Y3ZXpYUncvNjQw?x-oss-process=image/format,png
[format_png 6]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1bXlsSkdpYVpRQ2xnWEk1VkZVYXpEak5la2syQ3NDRVBTaWNHN3p0bUFjVWJsZEU4dXl1dVpkaWNBLzY0MA?x-oss-process=image/format,png
[format_png 7]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1Z1JTV3VkUmtuSVB0N1JTdURQRDY2VnFwcGhFcmVtdGdtWk1lQnFadVhpY3FzRzE2c2ZDU0lvZy82NDA?x-oss-process=image/format,png
[format_png 8]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1ajl4TmpmNGczN29IT1hVTXdMQ05VRkFpYURxbXBBbE9JQks2SmlhUk1DeTI1N041dmN3M1czWmcvNjQw?x-oss-process=image/format,png
[format_png 9]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1V2tFTDdpYmtwamJpYmJzZjN5ZThsUGVMbzlyMUpkYmtiMnJBSjhFVUFsM08yQnE4QmlheURRUG93LzY0MA?x-oss-process=image/format,png
[format_png 10]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1azZPN3ZEYnNHMXpKSTUybHFFN25kNGljaWNTTFA2aWNveWRoOFVpYWJaQUt2dnNZeTRUNDdpYWUwcFEvNjQw?x-oss-process=image/format,png
[format_png 11]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1T1Nwbzl2cXFkaWNUMXN6OWhrbmlhWDR6SGdpYXNpYldPaE1Dcmdxb1ZQSnE0R09keXc1Y0xBSXV1QS82NDA?x-oss-process=image/format,png
[format_png 12]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1RXlGazAxZUtHakZBVXRBYzVGbTgxTUcwSWp0a3dINjFraWNCNU90dWljc1g1V01vU1BONW1ZSWcvNjQw?x-oss-process=image/format,png
[format_png 13]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnRLY3UxbkpFMnZ1aFV3ZmliSzdZRzl1UTBjUXVkVkZFcGliek5pYkthTGRYUDR0VGhNOEpnckVGazdTT2J2blJOeGliemM1Y2VlemlhMDlGZy82NDA?x-oss-process=image/format,png
[format_png 14]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X2dpZi9jMlNpYjNNcDdwT1BpY2ZvT3hEc2liamRkWUpvemVoaWNMTjlwWEJiQ1JGWXJ6VXVnUkp0M29nbFBjSW1IbTliMk93SlppYlpsT2ljRjRMSGw0bmVhQmJrY1ZZZy82NDA?x-oss-process=image/format,png
[MySQL]: http://mp.weixin.qq.com/s?__biz=MzU2NDc4MjE2Ng%3D%3D&chksm=fc44f6cacb337fdc98763580c469fbbcafe428cbbfff8adc3211286c76fff55a131c87f04e45&idx=1&mid=2247484403&scene=21&sn=91a6e18de0ad52ab3baa67b28b25fb85#wechat_redirect
[Elasticsearch]: http://mp.weixin.qq.com/s?__biz=MzU2NDc4MjE2Ng%3D%3D&chksm=fc44f6cacb337fdced78515bc94f66117f934221004d1268ead6c323900456b933a535f39ffe&idx=2&mid=2247484403&scene=21&sn=1cf7cc23776b4aab41881da340066815#wechat_redirect
[Link 1]: http://mp.weixin.qq.com/s?__biz=MzU2NDc4MjE2Ng%3D%3D&chksm=fc44f6d1cb337fc72ee5a2202c8a559eec12e44f167db6c45919f16aeac1b6c085bf1531c930&idx=1&mid=2247484392&scene=21&sn=4ecf420faf3fad5778bac5ed11c9dc5e#wechat_redirect
[Redis]: http://mp.weixin.qq.com/s?__biz=MzU2NDc4MjE2Ng%3D%3D&chksm=fc44f6dbcb337fcdd56552b6a500167f1ac3d49e4d61028a10b223f3b6ce21a378e4415c688a&idx=1&mid=2247484386&scene=21&sn=73e58f95078cd8f93ab315c4c78d05a1#wechat_redirect
[Link 2]: http://mp.weixin.qq.com/s?__biz=MzU2NDc4MjE2Ng%3D%3D&chksm=fc44f6e2cb337ff47a54d15bdb0b4c8711319e26ad4db1a7d3e30c8c8bcc0b6a504f6bfca7c5&idx=1&mid=2247484379&scene=21&sn=4964f64ad5b6a5d024ead17cb518262f#wechat_redirect
[RAID]: https://blog.csdn.net/u012811805/article/details/105347148
[format_png 15]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X3BuZy94aWNXWVRTSUN6UnZ6aGRLck1pY1NQSWliZzhQRWJPa2E4bmpjOHJFZmFLa09YTHAyd21wckxpY0JRaWNYMWlhdVFzWEdTTDlpYXhreFZTb3RQQ2F2U2hva1NvVHcvNjQw?x-oss-process=image/format,png
[format_png 16]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9tbWJpei5xcGljLmNuL21tYml6X2dpZi94aWNXWVRTSUN6UnNKRmliZXRqdzJEblVBaG1VQkdrRWF0QXZlMkYxMEtuQjlTVnZzd01lRGxMVzUyY1d3RWljTmoyRU84bG9YQTZMcEhRbTQ5NFdCZUt1US82NDA?x-oss-process=image/format,png