🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🔒 धडा 09 — प्रवासातले आणि साठवलेले encryption: सील केलेली पाकिटे आणि कुलूपबंद कपाटे

📍 तुम्ही इथे आहात: 16 पैकी धडा 09 · मागील: lesson-08-iam-network · पुढील: lesson-10-k8s-rbac

📦 या ब्रँचमध्ये काय आहे

धडे 01–08, आणि शेवटचे cloud नियंत्रण: encryption. जो data फिरतो (browser आणि शाळेची website यांच्यात, app आणि database यांच्यात) तो TLS च्या आत प्रवास करतो. जो data पडून राहतो (disks, buckets, database files, backups) तो KMS key ने encrypt करून साठवला जातो. कोणत्या TLS versions ना परवानगी द्यायची, certificate काय सिद्ध करते, ते नावाशी का जुळायला हवे आणि expire का व्हायला नको, HSTS काय भर घालते, आणि KMS सोबत encryption at rest कसे चालते, हे तुम्ही शिकता.

sec/cloud.py — tls_ok(cfg): TLS configuration ची तपासणी (version, certificate expiry, certificate चे नाव)
sec/demo.py — python3 sec/demo.py tls
sec/test_sec.py — check L09

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

शाळा पालकांना प्रगतिपुस्तके पाठवते. दोन धोके:

रस्त्यावर. वाटेत पत्र हातात धरणारा कोणीही ते उघडू शकतो. म्हणून कार्यालय प्रत्येक पत्र एका सील केलेल्या पाकिटात 🔒 घालते जे फक्त पालकच उघडू शकतात. हेच encryption in transit (TLS).
कार्यालयात. रात्री कोणीतरी फायलींचे कपाट उघडू शकते. म्हणून कपाट कुलूपबंद असते, आणि त्याची चावी एका चावी-तिजोरीत 🗝️ असते (धडा 07). हेच encryption at rest (KMS).

आणि पाकीट आणणारा कुरियर एक ओळखपत्र बिल्ला दाखवतो. सुरक्षा कार्यालयातली दीपिका बिल्ल्यावरच्या तीन गोष्टी तपासते:

बिल्ल्यावरचे नाव हे पालकांना हव्या असलेल्या शाळेचेच नाव आहे;
बिल्ला मुदत संपलेला नाही;
बिल्ला पालकांचा विश्वास असलेल्या कार्यालयाने दिलेला आहे.

1990 च्या दशकातल्या जुन्या पाकिटांचे सील कमकुवत असतात. म्हणून कार्यालयाचा आणखी एक नियम आहे: "फक्त नवी पाकिटे — TLS 1.2 किंवा 1.3." आणि पुढच्या दारावर एक पाटी लिहिलेली असते: "नेहमी सील-पाकिटाचे दार वापरा, उघडे दार कधीच नाही." ती पाटी म्हणजे HSTS.

🗺️ आकृती

flowchart LR
    p["👪 parent's browser"] -->|"🔒 TLS 1.2 / 1.3<br/>certificate: name ✓ · expiry ✓ · issuer ✓"| lb["⚖️ load balancer / CloudFront<br/>ACM certificate · HSTS"]
    lb -->|"🔒 TLS again inside the VPC"| app["🍳 results API"]
    app -->|"🔒 TLS (rds.force_ssl)"| db["📒 database<br/>🗄️ encrypted at rest"]
    db --- k["🗝️ KMS key<br/>disks · buckets · backups"]
    bad["❌ api.school.example<br/>TLS 1.0 · 6 days left · wrong name"]

🗺️ काढलेली आकृती + एक lab: https://school-edh.pages.dev/security/lesson-diagrams.html#l09

❓ काय

Encryption in transit — data network वरून फिरत असताना encrypted असतो. Web वर हे TLS आहे (HTTPS मधला "S"). TLS तीन गोष्टी देते: गोपनीयता (वाटेवरचा कोणीही वाचू शकत नाही), अखंडता (कोणीही नकळत बदलू शकत नाही) आणि ओळख (certificate मुळे तुम्ही खऱ्या server शीच बोलता).
TLS versions — SSL 2, SSL 3, TLS 1.0 आणि TLS 1.1 निवृत्त झाले आहेत (RFC 8996 ने 2021 मध्ये 1.0 आणि 1.1 deprecated केले). TLS 1.2 आणि 1.3 ला परवानगी द्या; 1.3 ला प्राधान्य द्या (जलद handshake, फक्त मजबूत ciphers). जुन्या clients साठी 1.2 ठेवा, फक्त आधुनिक cipher suites सह.
Certificate — "ही public key school.example ची आहे" असे सांगणारी file, जिच्यावर browser चा विश्वास असलेल्या certificate authority (CA) ची सही असते. Browser connection नाकारतो जेव्हा:
- नाव जुळत नाही (host हा certificate च्या Subject Alternative Names मध्ये असायला हवा; wildcard *.school.example नेमकी एक पातळी कव्हर करतो, जसे api.school.example, पण a.b.school.example नाही);
- ते expire झाले आहे (किंवा अजून वैध झालेले नाही);
- देणारा (issuer) विश्वासार्ह नाही.
Certificate expiry — public certificates आता साधारण एक वर्ष किंवा त्याहून कमी टिकतात, आणि कमाल मुदत आणखी कमी होत आहे. म्हणून renewal आपोआप व्हायला हवे: AWS Certificate Manager (ACM) वापरात असलेली DNS-validated certificates renew करतो; Kubernetes मध्ये Let's Encrypt आणि cert-manager हे करतात. तरीही शेवटच्या तारखेच्या बऱ्याच आधी alert ठेवा.
HSTS (HTTP Strict Transport Security) — एक response header: Strict-Transport-Security: max-age=31536000; includeSubDomains. पहिल्या भेटीनंतर browser या site साठी वर्षभर फक्त HTTPS वापरतो — कोणी http:// टाइप केले तरी, किंवा एखाद्या network ने connection downgrade करण्याचा प्रयत्न केला तरी.
Encryption at rest — data जिथे साठवला आहे तिथेच encrypted असतो: EBS disks, S3 objects, RDS databases आणि त्यांचे snapshots, backups. AWS वर यासाठी KMS keys आणि envelope encryption वापरले जाते (धडा 07): data key data encrypt करते, KMS key data key encrypt करते.
AWS-managed key विरुद्ध customer-managed key — दोन्ही encrypt करतात. Customer-managed key मध्ये key policy (कोण decrypt करू शकतो) तुम्ही लिहिता, प्रत्येक वापर CloudTrail मध्ये पाहता, automatic rotation चालू करता, आणि आणीबाणीत key disable करता.
Key rotation — KMS ठराविक वेळापत्रकाने (default ने दरवर्षी) नवे key material बनवतो आणि जुने material ठेवतो, म्हणजे जुना data अजूनही decrypt होतो. तुमचा data पुन्हा encrypt करावा लागत नाही.

🤔 का

कारण दोन computers मधले network इतर लोकांचे असते: café मधले Wi-Fi, एखादा internet provider, वाटून वापरलेले data centre. TLS नसेल तर password किंवा grade वाटेत वाचला किंवा बदलला जाऊ शकतो. आणि चोरलेली disk, public snapshot किंवा leak झालेला backup ही समस्या तेव्हाच असते जेव्हा आतला data वाचता येण्याजोगा असतो. तुमच्या नियंत्रणातल्या key ने केलेले encryption at rest "कोणीतरी disk copy केली" याचे रूपांतर "कोणीतरी निरर्थक गोंगाट copy केला" यात करते. चुकीचे certificate नाव किंवा expire झालेले certificate ही छोटी सूचना देखील नाही: त्यामुळे लोकांना "तरीही पुढे जा" वर click करण्याची सवय लागते, आणि attacker ला नेमके तेच हवे असते.

🔧 कसे (या repo मध्ये)

sec/cloud.py मधले tls_ok(cfg) host, cert_names, min_version आणि days_to_expiry असलेली configuration घेते, आणि (ok, problems) परत करते. ते flag करते:

1.2 पेक्षा कमी किमान version;
14 दिवसांपेक्षा कमी उरलेले certificate;
certificate च्या नावांमध्ये नसलेला host.

sec/demo.py मधले tls() दोन sites तपासते: school.example (चांगली) आणि api.school.example (एकाच वेळी तीन समस्या). हे model नावे नेमकी जुळवते — त्याला wildcard नियम माहीत नाहीत. खरा browser results.school.example साठी *.school.example स्वीकारेल. ते तुम्हाला snippet मध्ये दिसेल.

🧪 करून पाहा

python3 sec/demo.py tls
python3 - <<'EOF'
import sys; sys.path.insert(0, "sec"); from cloud import tls_ok
base = dict(host="results.school.example", cert_names=["results.school.example"], min_version=1.2, days_to_expiry=60)
for label, change in (("as set up", {}), ("TLS 1.3 only", dict(min_version=1.3)), ("TLS 1.1 allowed", dict(min_version=1.1)),
                      ("expires in 14 days", dict(days_to_expiry=14)), ("expires in 13 days", dict(days_to_expiry=13)),
                      ("wildcard certificate", dict(cert_names=["*.school.example"]))):
    ok, problems = tls_ok({**base, **change})
    print(f"{label:<22} → {'ok' if ok else problems}")
EOF
python3 sec/test_sec.py

✅ तपासा — तुम्हाला काय दिसायला हवे

tls हे छापते:

═══ tls ═══
── school.example       → ok
── api.school.example   → TLS 1.0 allowed — require 1.2+; certificate expires in 6 days; certificate name does not match the host
   in transit: TLS 1.2+ everywhere, HSTS · at rest: encrypt disks, buckets, backups with KMS keys · rotate certificates automatically

✅ done — every door checked

तुमचा snippet हे छापतो:

as set up              → ok
TLS 1.3 only           → ok
TLS 1.1 allowed        → ['TLS 1.1 allowed — require 1.2+']
expires in 14 days     → ok
expires in 13 days     → ['certificate expires in 13 days']
wildcard certificate   → ['certificate name does not match the host']

शेवटच्या ओळीत model browser पेक्षा जास्त कडक आहे: खरा client results.school.example साठी *.school.example स्वीकारतो. Tests मध्ये ✅ L09 old TLS and near-expiry certificates are flagged आहे आणि शेवट 16/16 passed ने होतो.

🏁 तुम्ही आत्ताच काय सिद्ध केले

एका site मध्ये तीन वेगवेगळ्या TLS समस्या असू शकतात, आणि प्रत्येक एक विश्वास तोडायला पुरेशी आहे: जुना protocol, लवकरच expire होणारे certificate, आणि न जुळणारे नाव. ही तपासणी छोटी आणि जलद आहे, म्हणून ती प्रत्येक public endpoint पाहणाऱ्या scheduled job मध्ये हवी, कोणाच्या तरी आठवणीत नाही. Model साठी फक्त 1.3 ला परवानगी देणे ठीक आहे; प्रत्यक्षात प्रत्येक client 1.3 support करतो हे कळेपर्यंत 1.2 सुद्धा ठेवा.

⚠️ नेहमीच्या चुका

ते clients गेल्यानंतर वर्षानुवर्षे "जुन्या clients साठी" TLS 1.0 / 1.1 चालू ठेवणे
फक्त load balancer वर TLS, आणि load balancer पासून app पर्यंत व app पासून database पर्यंत साधे HTTP ("आतली बाजू सुरक्षित आहे")
calendar reminder वरून हाताने renew केलेले certificate — एक चुकलेला reminder म्हणजे outage
school.example साठीचे certificate api.school.example वर वापरणे
code मध्ये certificate तपासणी बंद करणे (verify=False, rejectUnauthorized: false) "फक्त testing साठी" आणि तसेच ship करणे
प्रत्येक subdomain HTTPS support करण्याआधीच HSTS चा max-age एका वर्षासाठी लावणे — मग includeSubDomains सह HSTS जे support करत नाहीत ते तोडते
प्रत्येकजण वापरू शकेल अशा key ने encryption at rest — फक्त "encrypted: yes" box नाही, key policy तपासा
encrypted database चा unencrypted snapshot किंवा backup, दुसऱ्या account मध्ये copy केलेला

🏭 प्रत्यक्ष वापरात

खऱ्या account वर — ACM कडून certificate, DNS द्वारे validated (ते वापरात असेपर्यंत ACM ते आपोआप renew करतो):

aws acm request-certificate --domain-name school.example \
    --subject-alternative-names www.school.example api.school.example \
    --validation-method DNS
aws acm describe-certificate --certificate-arn arn:aws:acm:ap-south-1:111122223333:certificate/0a1b2c3d-1111-2222-3333-444455556666 \
    --query 'Certificate.{status:Status,names:SubjectAlternativeNames,notAfter:NotAfter,renewal:RenewalEligibility}'

एक ALB listener जो फक्त TLS 1.3 आणि 1.2 ला परवानगी देतो, आणि एक port-80 listener जो फक्त redirect करतो:

aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:ap-south-1:111122223333:loadbalancer/app/school-alb/50dc6c495c0c9188 \
    --protocol HTTPS --port 443 \
    --certificates CertificateArn=arn:aws:acm:ap-south-1:111122223333:certificate/0a1b2c3d-1111-2222-3333-444455556666 \
    --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 \
    --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:ap-south-1:111122223333:targetgroup/results-api/6d0ecf831eec9f09
aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:ap-south-1:111122223333:loadbalancer/app/school-alb/50dc6c495c0c9188 \
    --protocol HTTP --port 80 \
    --default-actions 'Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

CloudFront — certificate us-east-1 मध्ये असायला हवे; distribution config मध्ये "ViewerProtocolPolicy": "redirect-to-https" लावा आणि:

"ViewerCertificate": {
  "ACMCertificateArn": "arn:aws:acm:us-east-1:111122223333:certificate/9f8e7d6c-aaaa-bbbb-cccc-ddddeeeeffff",
  "SSLSupportMethod": "sni-only",
  "MinimumProtocolVersion": "TLSv1.2_2021"
}

Response headers policy वापरून CloudFront कडून HSTS (किंवा header app कडून पाठवा):

aws cloudfront create-response-headers-policy --response-headers-policy-config '{
  "Name": "school-security-headers",
  "SecurityHeadersConfig": {
    "StrictTransportSecurity": { "Override": true, "IncludeSubdomains": true, "Preload": false,
                                 "AccessControlMaxAgeSec": 31536000 },
    "ContentTypeOptions": { "Override": true },
    "FrameOptions": { "Override": true, "FrameOption": "DENY" }
  }
}'

Customer-managed KMS key सह encryption at rest — key (दरवर्षी rotation सह), S3 default encryption, default ने EBS encryption, आणि एक encrypted RDS database जो TLS सुद्धा बंधनकारक करतो:

aws kms create-key --description "school data at rest" --query KeyMetadata.KeyId --output text
aws kms create-alias --alias-name alias/school-data --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab
aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

aws s3api put-bucket-encryption --bucket school-results --server-side-encryption-configuration '{
  "Rules": [{ "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "alias/school-data" },
              "BucketKeyEnabled": true }]
}'

aws ec2 enable-ebs-encryption-by-default --region ap-south-1
aws ec2 modify-ebs-default-kms-key-id --kms-key-id alias/school-data --region ap-south-1

aws rds create-db-instance --db-instance-identifier school-db --engine postgres \
    --db-instance-class db.t4g.medium --allocated-storage 50 \
    --master-username school_admin --manage-master-user-password \
    --storage-encrypted --kms-key-id alias/school-data \
    --db-parameter-group-name school-pg-tls     # a parameter group with rds.force_ssl = 1

(अस्तित्वात असलेल्या unencrypted RDS instance वर encryption जागच्या जागी चालू करता येत नाही: snapshot --kms-key-id सह copy करा, मग encrypted copy मधून restore करा.)

TLS न वापरणारी कोणतीही request नाकारणारी bucket policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyPlainHTTP",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::school-results", "arn:aws:s3:::school-results/*"],
    "Condition": { "Bool": { "aws:SecureTransport": "false" } }
  }]
}

तुमच्या laptop वरून live endpoint तपासा — तारखा आणि नावे, आणि जुने TLS नाकारले जाते ते:

echo | openssl s_client -connect school.example:443 -servername school.example 2>/dev/null \
    | openssl x509 -noout -subject -enddate -ext subjectAltName
openssl s_client -connect school.example:443 -servername school.example -tls1_1 </dev/null   # should fail to connect

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: "ALB uses a modern TLS policy", "S3 bucket has default encryption", "EBS encryption by default" आणि "RDS storage encrypted" यांसाठी AWS Config rules किंवा Security Hub controls चालू करा, आणि ACM certificates च्या DaysToExpiry वर alarm लावा. मग चुकीची setting ज्या दिवशी दिसते त्याच दिवशी robot ला सापडते, ज्या दिवशी काहीतरी तुटते त्या दिवशी पालकांना नाही.

⏭️ पुढे

इमारत खिडकीचे काम पूर्ण झाले: secrets, permissions, networks आणि encryption. पुढे आपण परिसराच्या दरवाजांकडे जातो — Kubernetes — आणि तिथला पहिला प्रश्न विचारतो: cluster मध्ये कोण काय करू शकतो?

git checkout lesson-10-k8s-rbac

🔒 Lesson 09 — Encryption in transit & at rest: sealed envelopes and locked cabinets

📍 You are here: Lesson 09 of 16 · Previous: lesson-08-iam-network · Next: lesson-10-k8s-rbac

📦 What's in this branch

Lessons 01–08, plus the last cloud control: encryption. Data that moves (between a browser and the school website, between the app and the database) travels inside TLS. Data that sits (disks, buckets, database files, backups) is stored encrypted with a KMS key. You learn which TLS versions to allow, what a certificate proves, why it must match the name and must not expire, what HSTS adds, and how encryption at rest works with KMS.

sec/cloud.py — tls_ok(cfg): a TLS configuration check (version, certificate expiry, certificate name)
sec/demo.py — python3 sec/demo.py tls
sec/test_sec.py — check L09

🧒 Explain like I'm 5

The school sends report cards to parents. Two dangers:

On the road. A letter can be opened by anyone who holds it on the way. So the office puts every letter in a sealed envelope 🔒 that only the parent can open. That is encryption in transit (TLS).
In the office. At night, someone could open the filing cabinet. So the cabinet is locked, and the key lives in a key safe 🗝️ (lesson 07). That is encryption at rest (KMS).

And the courier who brings the envelope shows an ID badge. Dipika at the security office checks three things on the badge:

the name on the badge is the name of the school the parent wanted;
the badge is not out of date;
the badge was issued by an office the parent trusts.

Old envelopes from the 1990s have weak seals. So the office also has a rule: "only the new envelopes — TLS 1.2 or 1.3." And on the front door a sign says: "always use the sealed-envelope door, never the open one." That sign is HSTS.

🗺️ Diagram

flowchart LR
    p["👪 parent's browser"] -->|"🔒 TLS 1.2 / 1.3<br/>certificate: name ✓ · expiry ✓ · issuer ✓"| lb["⚖️ load balancer / CloudFront<br/>ACM certificate · HSTS"]
    lb -->|"🔒 TLS again inside the VPC"| app["🍳 results API"]
    app -->|"🔒 TLS (rds.force_ssl)"| db["📒 database<br/>🗄️ encrypted at rest"]
    db --- k["🗝️ KMS key<br/>disks · buckets · backups"]
    bad["❌ api.school.example<br/>TLS 1.0 · 6 days left · wrong name"]

🗺️ Drawn version + a lab: https://school-edh.pages.dev/security/lesson-diagrams.html#l09

❓ What

Encryption in transit — data is encrypted while it moves over a network. On the web this is TLS (the "S" in HTTPS). TLS gives three things: privacy (nobody on the path can read), integrity (nobody can change it unnoticed) and identity (you talk to the real server, thanks to the certificate).
TLS versions — SSL 2, SSL 3, TLS 1.0 and TLS 1.1 are retired (RFC 8996 deprecated 1.0 and 1.1 in 2021). Allow TLS 1.2 and 1.3; prefer 1.3 (faster handshake, only strong ciphers). Keep 1.2 for older clients, with modern cipher suites only.
Certificate — a file that says "this public key belongs to school.example", signed by a certificate authority (CA) the browser trusts. A browser refuses the connection when:
- the name does not match (the host must be in the certificate's Subject Alternative Names; a wildcard *.school.example covers exactly one level, like api.school.example, but not a.b.school.example);
- it has expired (or is not valid yet);
- the issuer is not trusted.
Certificate expiry — public certificates now live about a year or less, and the maximum is getting shorter. So renewal must be automatic: AWS Certificate Manager (ACM) renews DNS-validated certificates that are in use; Let's Encrypt with cert-manager does it in Kubernetes. Alert well before the end date anyway.
HSTS (HTTP Strict Transport Security) — a response header: Strict-Transport-Security: max-age=31536000; includeSubDomains. After the first visit, the browser uses only HTTPS for this site for a year — even if someone types http:// or a network tries to downgrade the connection.
Encryption at rest — data is encrypted where it is stored: EBS disks, S3 objects, RDS databases and their snapshots, backups. On AWS this uses KMS keys with envelope encryption (lesson 07): a data key encrypts the data, the KMS key encrypts the data key.
AWS-managed key vs customer-managed key — both encrypt. A customer-managed key lets you write the key policy (who may decrypt), see every use in CloudTrail, turn on automatic rotation, and disable the key in an emergency.
Key rotation — KMS makes new key material on a schedule (yearly by default) and keeps the old material so old data still decrypts. Your data does not need re-encrypting.

🤔 Why

Because the network between two computers belongs to other people: Wi-Fi in a café, an internet provider, a shared data centre. Without TLS, a password or a grade can be read or changed on the way. And a stolen disk, a public snapshot or a leaked backup is only a problem if the data inside it is readable. Encryption at rest with a key you control turns "someone copied the disk" into "someone copied noise". A wrong certificate name or an expired certificate is not a small warning either: it trains people to click "continue anyway", which is exactly what an attacker needs.

🔧 How (in this repo)

tls_ok(cfg) in sec/cloud.py takes a configuration with host, cert_names, min_version and days_to_expiry, and returns (ok, problems). It flags:

a minimum version below 1.2;
a certificate with fewer than 14 days left;
a host that is not in the certificate's names.

tls() in sec/demo.py checks two sites: school.example (good) and api.school.example (three problems at once). The model compares names exactly — it does not know wildcard rules. A real browser would accept *.school.example for results.school.example. You will see that in the snippet.

🧪 Try it

python3 sec/demo.py tls
python3 - <<'EOF'
import sys; sys.path.insert(0, "sec"); from cloud import tls_ok
base = dict(host="results.school.example", cert_names=["results.school.example"], min_version=1.2, days_to_expiry=60)
for label, change in (("as set up", {}), ("TLS 1.3 only", dict(min_version=1.3)), ("TLS 1.1 allowed", dict(min_version=1.1)),
                      ("expires in 14 days", dict(days_to_expiry=14)), ("expires in 13 days", dict(days_to_expiry=13)),
                      ("wildcard certificate", dict(cert_names=["*.school.example"]))):
    ok, problems = tls_ok({**base, **change})
    print(f"{label:<22} → {'ok' if ok else problems}")
EOF
python3 sec/test_sec.py

✅ Verify — what you should see

tls prints:

═══ tls ═══
── school.example       → ok
── api.school.example   → TLS 1.0 allowed — require 1.2+; certificate expires in 6 days; certificate name does not match the host
   in transit: TLS 1.2+ everywhere, HSTS · at rest: encrypt disks, buckets, backups with KMS keys · rotate certificates automatically

✅ done — every door checked

Your snippet prints:

as set up              → ok
TLS 1.3 only           → ok
TLS 1.1 allowed        → ['TLS 1.1 allowed — require 1.2+']
expires in 14 days     → ok
expires in 13 days     → ['certificate expires in 13 days']
wildcard certificate   → ['certificate name does not match the host']

The last line is the model being stricter than a browser: a real client accepts *.school.example for results.school.example. The tests include ✅ L09 old TLS and near-expiry certificates are flagged and end with 16/16 passed.

🏁 What you just proved

One site can have three separate TLS problems, and each one is enough to break trust: an old protocol, a certificate about to expire, and a name that does not match. The check is small and fast, so it belongs in a scheduled job that looks at every public endpoint, not in someone's memory. Allowing only 1.3 is fine for the model; in real life keep 1.2 as well until you know every client supports 1.3.

⚠️ Common mistakes

leaving TLS 1.0 / 1.1 on "for old clients" years after those clients are gone
TLS only at the load balancer, plain HTTP from the load balancer to the app and from the app to the database ("the inside is safe")
a certificate renewed by hand, from a calendar reminder — one missed reminder is an outage
a certificate for school.example used on api.school.example
turning off certificate checks in code (verify=False, rejectUnauthorized: false) "just for testing" and shipping it
max-age for HSTS set for a year before every subdomain supports HTTPS — HSTS with includeSubDomains then breaks the ones that do not
encryption at rest with a key everyone may use — check the key policy, not only the "encrypted: yes" box
an unencrypted snapshot or backup of an encrypted database, copied to another account

🏭 In production

On a real account — a certificate from ACM, validated through DNS (ACM renews it automatically while it is in use):

aws acm request-certificate --domain-name school.example \
    --subject-alternative-names www.school.example api.school.example \
    --validation-method DNS
aws acm describe-certificate --certificate-arn arn:aws:acm:ap-south-1:111122223333:certificate/0a1b2c3d-1111-2222-3333-444455556666 \
    --query 'Certificate.{status:Status,names:SubjectAlternativeNames,notAfter:NotAfter,renewal:RenewalEligibility}'

An ALB listener that allows only TLS 1.3 and 1.2, and a port-80 listener that only redirects:

aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:ap-south-1:111122223333:loadbalancer/app/school-alb/50dc6c495c0c9188 \
    --protocol HTTPS --port 443 \
    --certificates CertificateArn=arn:aws:acm:ap-south-1:111122223333:certificate/0a1b2c3d-1111-2222-3333-444455556666 \
    --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 \
    --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:ap-south-1:111122223333:targetgroup/results-api/6d0ecf831eec9f09
aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:ap-south-1:111122223333:loadbalancer/app/school-alb/50dc6c495c0c9188 \
    --protocol HTTP --port 80 \
    --default-actions 'Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

CloudFront — the certificate must be in us-east-1; in the distribution config set "ViewerProtocolPolicy": "redirect-to-https" and:

"ViewerCertificate": {
  "ACMCertificateArn": "arn:aws:acm:us-east-1:111122223333:certificate/9f8e7d6c-aaaa-bbbb-cccc-ddddeeeeffff",
  "SSLSupportMethod": "sni-only",
  "MinimumProtocolVersion": "TLSv1.2_2021"
}

HSTS from CloudFront with a response headers policy (or send the header from the app):

aws cloudfront create-response-headers-policy --response-headers-policy-config '{
  "Name": "school-security-headers",
  "SecurityHeadersConfig": {
    "StrictTransportSecurity": { "Override": true, "IncludeSubdomains": true, "Preload": false,
                                 "AccessControlMaxAgeSec": 31536000 },
    "ContentTypeOptions": { "Override": true },
    "FrameOptions": { "Override": true, "FrameOption": "DENY" }
  }
}'

Encryption at rest with a customer-managed KMS key — the key (with yearly rotation), S3 default encryption, EBS encryption by default, and an encrypted RDS database that also requires TLS:

aws kms create-key --description "school data at rest" --query KeyMetadata.KeyId --output text
aws kms create-alias --alias-name alias/school-data --target-key-id 1234abcd-12ab-34cd-56ef-1234567890ab
aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

aws s3api put-bucket-encryption --bucket school-results --server-side-encryption-configuration '{
  "Rules": [{ "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "alias/school-data" },
              "BucketKeyEnabled": true }]
}'

aws ec2 enable-ebs-encryption-by-default --region ap-south-1
aws ec2 modify-ebs-default-kms-key-id --kms-key-id alias/school-data --region ap-south-1

aws rds create-db-instance --db-instance-identifier school-db --engine postgres \
    --db-instance-class db.t4g.medium --allocated-storage 50 \
    --master-username school_admin --manage-master-user-password \
    --storage-encrypted --kms-key-id alias/school-data \
    --db-parameter-group-name school-pg-tls     # a parameter group with rds.force_ssl = 1

(An existing unencrypted RDS instance cannot be switched on in place: copy a snapshot with --kms-key-id, then restore from the encrypted copy.)

A bucket policy that refuses any request that does not use TLS:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyPlainHTTP",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::school-results", "arn:aws:s3:::school-results/*"],
    "Condition": { "Bool": { "aws:SecureTransport": "false" } }
  }]
}

Check a live endpoint from your laptop — the dates and names, and that old TLS is refused:

echo | openssl s_client -connect school.example:443 -servername school.example 2>/dev/null \
    | openssl x509 -noout -subject -enddate -ext subjectAltName
openssl s_client -connect school.example:443 -servername school.example -tls1_1 </dev/null   # should fail to connect

🏭 Why this matters in production: turn on AWS Config rules or Security Hub controls for "ALB uses a modern TLS policy", "S3 bucket has default encryption", "EBS encryption by default" and "RDS storage encrypted", and add an alarm on DaysToExpiry for ACM certificates. Then a bad setting is found by a robot the day it appears, not by a parent the day it breaks.

⏭️ Next

The building desk is done: secrets, permissions, networks and encryption. Next we walk to the campus gates — Kubernetes — and ask the first question there: who may do what in the cluster?

git checkout lesson-10-k8s-rbac

← Previousiam network Next →k8s rbac

This page is the lesson's README from the lesson-09-encryption branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.