Zilog EZ80F91AZA User Manual download pdf (Page 56)

UM020107-1211 SSL Configuration

ZTP Network Security SSL Plug-In

User Manual

The SSL protocol layer internally sets the SSL_X509_TRUSTED flag on all certificates that

it implicitly trusts, or on those certificates for which the

VerifyCertificate callback

function returns

SSL_SUCCESS.

The ZTP Network Security SSL Plug-In does not check if the certificate has been revoked. No

attempt is made to contact certificate issuers and obtain a list of certificates that have been revoked.

If this functionality is required, it must be implemented within the

VerifyCertificate

callback

function.

Verifying All Certificates

In some instances, it is useful to examine all certificates – even those that the SSL layer

implicitly trusts (i.e., the

SSL_X509_TRUSTED flag is set), especially if the application

must perform additional integrity checks on the certificate beyond the basic verification

performed in the SSL library. For example, the application can obtain the issuer’s certifi-

cate revocation list (CRL) to determine if an otherwise-valid certificate should be rejected.

To force the

VerifyCertificate callback to be called for all certificates processed by

the SSL handshake protocols, set the value of the

SSL_PresentAllCertificates con-

figuration variable to TRUE. This variable is located in the

ssl_conf.c configuration

file. Its default definition is shown in the following code fragment:

SSL_BOOL SSL_PresentAllCertificates = FALSE;

Signature Verification

A digital signature provides a mechanism that allows an entity to verify that another entity

was the originator of a specific piece of digital information. This verification establishes

the authenticity of the information. To generate a signature, the information is typically

hashed into a fixed-sized quantity using a digest algorithm, and then subjected to a public

key operation using the signatory’s private key.

Any other entity possessing the signatory’s public key can then perform the complemen-

tary public key operation using the signatory’s public key and compare the recovered

digest to a locally-generated digest of the same piece of information. If these digests are

identical, the information is deemed authentic; i.e., the signatory’s private key has not

been compromised. If the key remains secure, then by the nature of the asymmetric public

key algorithm, it is extremely unlikely that an attacker could forge the signature on an

altered block of information.

All X.509 certificates used by SSL must be signed by an issuer. By verifying the signature

on a certificate, the recipient can be relatively certain that the certificate is accurate and

identical to the information that the issuer originally signed. If it can be proven (via an

Note:

1 2 ... 51 52 53 54 55 56 57 58 59 60 61 ... 78 79

Comments to this Manuals

No comments

Zilog EZ80F91AZA User Manual Page 56

Comments to this Manuals

Related products and manuals for Sensors Zilog EZ80F91AZA