Learn you some 'ssl' for much security!
summary
Erlang/OTP's ssl defaults silently allow insecure connections (default verify: verify_none), so HTTPS clients need explicit cacertfile and to disable session resumption during tests (reuse_sessions false) because resumed sessions skip certificate checks. Use the OS CA store or packages like certify / ca_store rather than baking certs into releases; hostname checks require customize_hostname_check for wildcard SANs; OTP only supports CRL-based revocation (slow per-handshake fetch); be careful filtering ciphers (empty result falls back to defaults) and cipher formats (Elixir strings are binaries). Use Mint or Tortoise for safer defaults.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 2:20Clients
- 3:40HTTP
- 4:30Authenticity and integrity
- 6:25Test endpoints
- 7:00X509
- 7:38Verify
- 8:40What happened
- 9:22Solution
- 10:07Testdriven development
- 10:30TLS session resumption
- 11:52Real session false
- 13:56Always Trust Store
- 16:56wildcard certificate
- 18:20custom hostname check
- 20:34HTTP clients
- 21:36Certifications
- 22:06SSL Options
- 25:46Certificate Revocation
- 27:28HTTP Guide
- 28:25Cipher Filtering
- 29:06Empty List
- 29:32Elixir Strings
- 30:34Certificate Key
- 31:42Private Key
- 33:11Key takeaways
- 34:11Thank you
- 34:21Questions
