{"id":2717,"date":"2014-05-21T13:05:04","date_gmt":"2014-05-21T13:05:04","guid":{"rendered":"http:\/\/blog.eginnovations.com\/?p=2717"},"modified":"2022-10-31T09:19:26","modified_gmt":"2022-10-31T13:19:26","slug":"ssl-monitoring-web-applications","status":"publish","type":"post","link":"https:\/\/www.eginnovations.com\/blog\/ssl-monitoring-web-applications\/","title":{"rendered":"SSL Certificates \u2013 Not Just for Web Applications"},"content":{"rendered":"

When a client and server communicate, secure socket layer (SSL) ensures that the communication is private and secure by providing authentication, encryption, and integrity checks. A general assumption is that SSL handshake and SSL data transfer only happens between a Web Browser and a Web Server, so SSL Certificates are only required for Web Servers in the overall IT Infrastructure. In reality SSL Certificates can be used for many key applications in an IT infrastructure – Web servers, Java application servers, databases (Oracle, SQL), Microsoft Active Directory servers and mail servers like Microsoft Exchange can all use SSL.<\/p>\n

\"SSL<\/a><\/p>\n

 <\/p>\n

Isn’t it Enough to Just Protect the Web Servers using SSL?<\/strong><\/p>\n

\"\"<\/a><\/p>\n

Application environments have become complex. Many infrastructure tiers are involved in supporting the service and the different tiers communicate with each other to support the service. \u00a0The servers involved could be in different geographic locations. With the increasing use of cloud computing, some of the servers involved may even be hosted on public clouds.<\/p>\n

SSL secures all communications between any two servers. If servers are unprotected, hackers could actively eavesdrop all the communications and maybe able to inject new ones. The more security critical the application, the more important it is to protect it with SSL.\u00a0This is the reason why some of the core IT servers \u2013 Web Servers, Java application servers, Database Servers, messaging servers, \u00a0Active Directory servers, and Microsoft Exchange \u2013 are often configured with SSL certificates.<\/p>\n

 <\/p>\n

Why protect these services with SSL?<\/strong><\/p>\n\n\n\n\n
Services<\/td>\nWhy SSL?<\/td>\nWithout SSL<\/td>\n<\/tr>\n
\n\n\n\n\n\n
\"\"<\/td>\n<\/tr>\n
Web Servers<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\nSSL ensures secure communication between a browser and a Web Server<\/td>\nHackers can easily steal confidential information – credit card, PIN, Social Security numbers and other personal information of a customer.<\/td>\n<\/tr>\n
\n\n\n\n\n\n
\"\"<\/td>\n<\/tr>\n
Application Servers<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\nSSL protects access to business logic and secures data access service from application server to other systems and database<\/td>\nUnauthorized personal can modify critical data by accessing the database and other systems.<\/td>\n<\/tr>\n
\n\n\n\n\n\n
\"\"<\/td>\n<\/tr>\n
Microsoft Exchange<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\nSSL enables emails exchanged between mail client and exchange server to be encrypted and secured<\/td>\nAttackers can steal important emails and passwords of key executives.<\/td>\n<\/tr>\n
\n\n\n\n\n\n
\"\"<\/td>\n<\/tr>\n
Microsoft Active Directory<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\nSSL secures access to user accounts, administrative groups, server accounts and resource accounts stored in Active Directory<\/td>\nActive Directory can be compromised and the damage might be a substantial monetary loss or even a serious blow to the reputation of the organization.<\/td>\n<\/tr>\n
\n\n\n\n\n
\"\"<\/td>\n<\/tr>\n
Databases<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\nSSL secures data transfer across the network between instances of databases and other systems of that application environment<\/td>\nHackers can steal critical data stored in the database.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Monitoring SSL Certificates<\/strong><\/p>\n

SSL certificates often have a validity period and if ever an SSL certificate becomes invalid, the application that uses it will stop working. So monitoring of SSL certificates is important. The key requirements for SSL certificate monitoring include:<\/p>\n