2

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent firefox/chrome) to be safe.

I wanted to use a basic auth system working under TLS. That would be great but the certificates usually have to be installed on the server which basically kills the portability aspect.

Is there a way to use TLS that doesn't involve having to install it in the server? If not, are there any alternatives to it that fit the requirements?

I concede that due to the constraints presented I may have to find alternatives to an encryption protocol to improve security in the above mentioned pages, like an authentication system that manages to build a secure connection after a clever "handshake".

What such systems do you know of that would respect the project constraints?

Keep in mind that I'm looking for something that was made and used, I have ideas of how I could make my own but I won't if I can avoid it, which would be ideal.

1
  • 3
    Much better question. Now, what do you want to be secure against? What precisely do you want to protect? The content? Access to the CMS? Data in transit?
    – schroeder
    Apr 25 '15 at 17:15
1

Certificates may be generated automatically on the server upon first launch. The EFF is even building a project, Let's Encrypt, precisely targeting automated generation, configuration and update of browser-trusted certificates.

1
  • Not all hosts will provide cli access but even a lot of free/shared ones will, I hope this project lauches and is adopted successfully, it seems very promising, thank you for your contribution.
    – uhx116
    Apr 25 '15 at 22:00
0

I wanted to use a basic auth system working under TLS. That would be great but the certificates usually have to be installed on the server which basically kills the portability aspect.

Why exactly do you think that TLS kills portability? Besides SSL/TLS there is only IPSec, which provides similar security, although it is far less portable. SSL/TLS has good support in clients, and installing a certificate on the server should not be too much of an effort for any decently skilled administrator. Other web applications require this too, so I don't see a problem here.

I concede that due to the constraints presented I may have to find alternatives to an encryption protocol to improve security in the above mentioned pages, like an authentication system that manages to build a secure connection after a clever "handshake".

I strongly discourage you from that. Coming up with secure protocols is difficult and wasted effort.

1
  • "Why exactly do you think that TLS kills portability?" I said it and you said it, installation. Do most hosts including free and shared support you installing your own TLS certificate? The answer is no. Do you have to install it instead of just copying it over? The answer seems to be yes but I was hoping for for a clever way of not having to. Besides, you quoted my text and talked about but didn't addressed the questions, any of them. Thank you for your answer and sorry if I seem rude, I didn't meant to, not with you anyway.
    – uhx116
    Apr 25 '15 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.