Title: Notes on Demos
Course: Introduction to SSL/PKI > Section: Information For Teachers

Notes on Demos

OpenSSL has many capabilities. One of which we will use in the demos. It has a demo client and server to illustrate a SSL connection.

It is very important to set up the directory structure required by the demos scripts before running them. This seems to be a problem for students to do correctly. It is probably a good idea to check each student's machine before running the demos.

Each student should run the demos on their own machine. This give them a hands on feel for what is going on.

Go over the output of the scripts and describe what is there and why.

Port numbers and server host names are "hard coded" in the scripts. They can be modified as needed.

When editing/modifying scripts, DO NOT use an editor that embeds formatting information in the file (for example, word,). Use only a simple ASCII editors such as notepad or vi. (This is less of a problem on Linux/Unix because there a lots of these kinds of editors available.)

After running the basic scripts, have the students modify their client and server scripts to access each other. This demonstrates the need for the client to have a copy of the public certificate of the CA that created the serve'rs certificates.

Note: The server must also give the client its IP address so that it can used by the "run client" script. To find out the server IP address:

- Windows - execute the command "ipconfig" in a command window
- Linux/Unix - execute the command "ifconfig" in a command window

This demonstrates the problem of how do CA certificates get distributed? With web browsers they come pre-installed. A new CAs certificates must be distributed "out of band" somehow.

One way is for a new CAs to pay commercial companies like Microsoft to add their certificate to their browsers.

Another way is for the CA to send its certificate "out of band" to its clients. Perhaps pass it around on a usb drive? What would the students suggest?

Yet another way is built into browsers. When a browser access a web site that uses a certificate from an unknown CA, an error window pops up. Within this window you can add the unknown CA's certificate to the list of trusted CAs in the browser. This, however, create a security risk. What if you accidentally access a "bad" site that is spoofing a "good" site?

OpneSSL has a demo "fake" web server that can be used for a demo. To execute it, run the "run server www" script.

Note: The server is listening for connections on port 4949.

To connect to the server using https (secure http) enter the following URL in a browser:

https://serveraddress:4949

Note: The port 4949 in "hard coded" into the scripts. It can be modified as needed, but both the server and client must use the same port. The server is waiting for a connection on the port, and the client initiates a connection on the port.