2

I currently have Implementing SSL / TLS Using Cryptography and PKI Joshua Davies. It is very recent and covers even newer TLS version 1.1 and 1.2 and ECC. It is based on many C sample that are dedicated for this book and apply more for people wanting to develop or extend a tls stack understanding deep internal crypto, OpenSSL is mentioned but openssl usage sample is limited to 3 pages ( book is 663 pages ).

SSL and TLS Designing and Building Secure Systems from Eric Rescorla which is the best book i could find about the subject but it is outdated. It covers to TLS 1.0 ( 2000 ). It contains general SSL TLS description with some history and cover general Security Concepts and TLS from basics to advanced with details. BUT still imited to TLS v1.0 It give hints to develop with ( but not only with ) OpenSSL over 40 pages ( Coding with SSL ) but with very old openssl ( prior to 0.9.7 ).

And the openssl 'reference' : Network Security with OpenSSL from John Viega, Matt Messier & Pravir Chandra, It covers openssl 0.9.7 then up to TLS 1.0, it is too old. It comes with many samples and many hints. It cover usage of openssl tools to generate certificates, sign , crypt . Coding with openssl server and clients I had more difficulties to enter in this book that for the others, its writing is less fluent.

Still i didn't find a book giving up to date advice to code securely using openssl for latest known TLS threats addressed by various extensions.

I wonder if an up to date book dedicated to coding with OpenSSL describing latest API and covering TLS 1.1 and 1.2 ?

[ Still i didn't yet read 'Bulletproof SSL TLS and PKI' or other references given in answers ]

[ And yes some opinion can be based on quality of book, but not on coverage ]

closed as primarily opinion-based by TildalWave, Adi, Lucas Kauffman, Xander, Eric G Mar 24 '14 at 14:18

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • i reworded it, is it still too much 'opinion based' ? – philippe lhardy Mar 24 '14 at 18:02
  • I'm looking into this too. The authoritative book (Rescorla) had got yet another 2 years older. So how did it go? – Pacerier Nov 5 '16 at 7:03
3

I think what you might be looking for is something like Bulletproof SSL TLS and PKI which is so new it's not even out yet!

  • what is ready is released, meaning: you can read and download what is ready yet. – that guy from over there Mar 24 '14 at 6:47
  • seems that available part is the one covering openssl samples, good :-) – philippe lhardy Mar 24 '14 at 9:54
1

i saw this floating around lately, but cannot say anything about the quality: crypto 101 by Laurens Van Houtven

  • will be good once finished, many TODO and no openssl samples at all. – philippe lhardy Mar 24 '14 at 9:57
1

Mozilla OpSec's Server Side TLS HowTo is the best source I know of. Not a book though.

It's kinda hard to stay up-to-date with books novaday with all those Snowden leaks.

  • I don't get your last para? – Pacerier Nov 5 '16 at 7:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.