HTTPS in Simple Terms: From Principles to Practice

Name: HTTPS in Simple Terms: From Principles to Practice
ISBN: 9787121341786

虞卫东Publishing House of Electronics Industry · ChinaJul 2018

3.6

Word count: 145K words
Chapters: 76
ISBN: 9787121341786

Report an error Find this book

Summary

Deep Dive into HTTPS: From Principles to Practice is a professional book on HTTPS that comprehensively explains knowledge in the HTTPS field, including cryptography, the OpenSSL command line, certificates, the TLS protocol, HTTPS website performance optimization, best practices for HTTPS websites, and HTTPS architecture design for large websites.

Editor's review

Yu Weidong's Deep Dive into HTTPS: From Principles to Practice is a recent work in the network security field that combines depth and practicality, and is especially suitable for developers and operations personnel who want to systematically master the core technologies of HTTPS. The book does not simply list configuration steps; instead, it starts from the foundations of cryptography (such as symmetric/asymmetric encryption, digital certificates, and digest algorithms) and progresses layer by layer, clearly revealing how the HTTPS protocol (TLS/SSL) uses these building blocks to construct a reliable secure communication channel. Its highlight is the 'deep yet accessible' writing style, which presents the complex handshake process and key negotiation mechanisms through flowcharts and analogies, lowering the barrier to understanding. At the same time, the book covers practical operations with the OpenSSL toolchain, configuration and optimization for common deployment scenarios (such as Nginx and Apache), and discussion of advanced topics such as performance tuning and protection against protocol downgrade attacks, reflecting a strong engineering orientation. For technical personnel who want not only to 'use it' but also to 'understand why it works' and to troubleshoot real problems, this book provides a solid theoretical map and a practical tool guide.

Who it's for

A good fit for

Web backend developers who want to systematically understand the principles of the HTTPS/TLS protocol rather than merely configuring it
Technical personnel engaged in system operations, DevOps, or security who need to deploy, optimize, and troubleshoot HTTPS services
Students in computer-related majors or self-learners who want to strengthen their foundation in network security and cryptography applications
Technology enthusiasts who are curious about the details of network protocols and want to deeply understand the security mechanisms behind everyday browsing behavior

Not a good fit for

Pure frontend developers or beginners who only need to quickly complete basic HTTPS configuration for a website and have no deep interest in the underlying principles
Senior security researchers seeking high-level network security strategy or practical penetration testing techniques

Reading tips

It is recommended to read the chapters in order; the basic cryptography knowledge in the first three chapters is the foundation for understanding the subsequent protocols, so do not skip it
Be sure to practice hands-on with the command examples in the book and use tools such as OpenSSL to verify your understanding
Use this book alongside RFC documents or official protocol standards as references to obtain more precise technical details

About the publisher

Publishing House of Electronics Industry China · Founded in 1982

The Publishing House of Electronics Industry is a comprehensive publisher distinguished by its focus on electronic information and related fields. Judging from the more than 3,000 titles in its catalogue, its publishing covers programming and design, artificial intelligence, computer science, finance and economics, photography, and social sciences, attending both to cutting-edge technology and to general readers. Representative titles include Factor Investing: Methods and Practice, x86 Assembly Language: From Real Mode to Protected Mode, The RISC-V Reader, Artificial Intelligence: Speech Recognition, Understanding and Practice, Phased Array Radar Technology, Radar Target Characteristics, and 100 Go Mistakes and How to Avoid Them, most of which centre on technical methods and engineering practice. Its authors include Shi Chuan, Li Zhong, Wang Xiaobo, David Patterson, Andrew Waterman, and Yu Zihao, among others from China and abroad. Owing to limited public information, no further publishing features are elaborated here.

版权信息
内容简介
序1
序2
前言
第1章 HTTP介绍
1.1 什么是Web
1.2 理解HTTP
1.3 网络模型
1.4 协议安全分析
1.5 Web应用安全
第2章密码学
2.1 对于密码学的认知
2.2 随机数
2.3 Hash算法
2.4 对称加密算法
2.5 消息验证码
2.6 公开密钥算法
2.7 密钥
2.8 密钥协商算法
2.9 椭圆曲线密码学
2.10 数字签名
2.11 DSA数字签名算法
2.12 算法安全性和性能
第3章宏观理解TLS
3.1 TLS/SSL协议综述
3.2 TLS/SSL协议背后的算法
3.3 HTTPS总结
3.4 实施HTTPS网站的必备条件
3.5 从用户的角度看HTTPS
第4章选择HTTPS的必要性和疑惑
4.1 部署HTTPS的疑惑
4.2 部署HTTPS的必要性
第5章快速搭建一个HTTPS网站
5.1 HTTPS网站构建分析
5.2 获取证书和密钥对
5.3 部署证书和密钥对
5.4 测试HTTPS
5.5 301重定向
5.6 HSTS
5.7 CSP
第6章证书
6.1 X.509标准和PKI
6.2 证书
6.3 证书链
6.4 CRL
6.5 OCSP
6.6 OCSP封套
6.7 OpenSSL命令行管理证书
6.8 其他
第7章 Let’s Encrypt免费证书
7.1 Let’s Encrypt
7.2 Let’s Encrypt工作原理
7.3 Certbot客户端
7.4 Let’s Encrypt的其他信息
第8章 TLS协议分析
8.1 如何理解RFC文档
8.2 描述语言
8.3 TLS/SSL协议概述
8.4 TLS记录层协议
8.5 TLS/SSL握手协议
8.6 扩展
8.7 基于Session ID的会话恢复
8.8 SessionTicket
8.9 使用Wireshark学习TLS/SSL协议
第9章 HTTPS性能和安全
9.1 密码套件
9.2 安全性
9.3 性能
第10章 HTTPS网站实战
10.1 工具化配置HTTPS
10.2 自动化测试HTTPS网站
10.3 OpenSSL命令行工具
10.4 实战HTTPS网站部署
10.5 大型网站部署HTTPS
反侵权盗版声明

FAQ

Does this book require a strong cryptography background?

No. The first few chapters specifically explain the necessary basic cryptography knowledge, such as symmetric encryption, asymmetric encryption, hash functions, and digital certificates. These are introduced from scratch and are sufficient to support the later understanding of the HTTPS protocol.

What environment or tools are used for the practical sections of the book?

The practical sections are mainly based on the Linux environment, using the OpenSSL command-line tool and mainstream web servers such as Nginx/Apache for configuration and demonstration. The book provides specific commands and configuration snippets.

Is the content of this book outdated, and can it still adapt to the latest TLS 1.3?

The book's core principles (such as encryption, authentication, and integrity) are timeless. The book explains the TLS 1.2 handshake process in detail, which is the foundation for understanding any version of TLS. As for TLS 1.3, although the protocol had not yet been finalized when the book was published, the book mentions its key improvement directions. After understanding the content of this book, it will be easier to consult updated materials on TLS 1.3.

Comments

Find this book

This site is an index: you start “Search all sources” in your browser, and the entries it lists all point to third-party sites; please judge their availability yourself.

About the author

虞卫东 Author

Yu Weidong is a Chinese author of technical books. Public information about him is limited, and his nationality, dates of birth and death, educational background, and professional experience cannot currently be confirmed. According to the library's records, he has only one work, HTTPS in Plain Language: From Principles to Practice, which is categorized under programming and design and is a technical book centered on the HTTPS protocol. The title's phrasing, "in plain language" and "from principles to practice," suggests his approach as a writer: he explains the fundamental principles behind the protocol while also emphasizing how the knowledge applies in real-world scenarios, striving for a balance between conceptual explanation and hands-on practice. This kind of subject generally requires a systematic understanding of network communication and security mechanisms, as well as the ability to organize content clearly and progressively so as to lower the barrier for readers. Because other information about the author is unavailable, any judgment of his writing style and influence can only be based on this single work, and further background remains to be supplied by later materials.