2

I currently have Implementing SSL / TLS Using Cryptography and PKI Joshua Davies. It is very recent and covers even newer TLS version 1.1 and 1.2 and ECC. It is based on many C sample that are dedicated for this book and apply more for people wanting to develop or extend a tls stack understanding deep internal crypto, OpenSSL is mentioned but openssl usage sample is limited to 3 pages ( book is 663 pages ).

SSL and TLS Designing and Building Secure Systems from Eric Rescorla which is the best book i could find about the subject but it is outdated. It covers to TLS 1.0 ( 2000 ). It contains general SSL TLS description with some history and cover general Security Concepts and TLS from basics to advanced with details. BUT still imited to TLS v1.0 It give hints to develop with ( but not only with ) OpenSSL over 40 pages ( Coding with SSL ) but with very old openssl ( prior to 0.9.7 ).

And the openssl 'reference' : Network Security with OpenSSL from John Viega, Matt Messier & Pravir Chandra, It covers openssl 0.9.7 then up to TLS 1.0, it is too old. It comes with many samples and many hints. It cover usage of openssl tools to generate certificates, sign , crypt . Coding with openssl server and clients I had more difficulties to enter in this book that for the others, its writing is less fluent.

Still i didn't find a book giving up to date advice to code securely using openssl for latest known TLS threats addressed by various extensions.

I wonder if an up to date book dedicated to coding with OpenSSL describing latest API and covering TLS 1.1 and 1.2 ?

[ Still i didn't yet read 'Bulletproof SSL TLS and PKI' or other references given in answers ]

[ And yes some opinion can be based on quality of book, but not on coverage ]

2
  • i reworded it, is it still too much 'opinion based' ? Commented Mar 24, 2014 at 18:02
  • I'm looking into this too. The authoritative book (Rescorla) had got yet another 2 years older. So how did it go?
    – Pacerier
    Commented Nov 5, 2016 at 7:03

3 Answers 3

3

I think what you might be looking for is something like Bulletproof SSL TLS and PKI which is so new it's not even out yet!

2
  • what is ready is released, meaning: you can read and download what is ready yet. Commented Mar 24, 2014 at 6:47
  • seems that available part is the one covering openssl samples, good :-) Commented Mar 24, 2014 at 9:54
1

i saw this floating around lately, but cannot say anything about the quality: crypto 101 by Laurens Van Houtven

1
  • will be good once finished, many TODO and no openssl samples at all. Commented Mar 24, 2014 at 9:57
1

Mozilla OpSec's Server Side TLS HowTo is the best source I know of. Not a book though.

It's kinda hard to stay up-to-date with books novaday with all those Snowden leaks.

1
  • I don't get your last para?
    – Pacerier
    Commented Nov 5, 2016 at 7:05

Not the answer you're looking for? Browse other questions tagged .