Network Security with OpenSSL

Let's get this out of the way: if you're starting a new project and you need a SSL library, then OpenSSL is *not* the library you are looking for. The library documentation, and the API, are so confusing as to make one's eyes bleed. Confusing and often-undocumented default settings for an armada of parameters, and entirely missing documentation for certain important features, makes it too easy to achieve "security" with massive holes, and makes it too difficult to implement security according to accepted best practices. Speaking as someone who has used OpenSSL - you have better choices.That said, if you *must* use OpenSSL for some reason or other, then this book is the missing user manual that the library so desperately needs. It does a good job explaining the library APIs, both libssl and libcrypto, and additionally provides worked examples of common implementation tasks. It explains things well enough that, once you've read through it and rewritten the examples on your own, the library begins to make some sort of *sense* - if such a thing is really possible - and, if you combine this book with the library docs (which will now be less confusing) and the source for the OpenSSL command-line tools (which will now even be *legible*!), you now stand a chance of successfully building something useful.There is an important caveat: this book was written for a much earlier version of OpenSSL, and thus certain important features are referred to by the book as "not yet available" or are simply not mentioned. That said, this will be less of an obstacle once you reach the point when the library begins to make its own strange sort of sense.If your project requires OpenSSL, and there's really no way around it, then get this book. It will save you *months* of fruitlessly spinning your wheels, and it will get you on track.

As a software developer writing both client and server based SSL code, this book helped a lot. There are a lot of details that are missing from the OpenSSL documentation that are covered in this book.I am hoping that the author will publish a new version to cover the 1.0 release.Very easy read for an experienced C/C++ developer with a number of code examples.I give this book an 8+ and is a permanent part of my coding library.

Without people realizing it the majority of SSL enabled websites worldwide are using the OpenSSl library (through the Apache web server). Only large companies like Microsoft can afford to develop their own proprietary implementation of SSL.The SSL library is C-library easily compiled as C++, and ported to PHP, PERL and JAVA etc.It can be as has been compiled under Windows, Mac and Linux. OpenSSL is even shipped with Mac and Linux.The OpenSSL package basically consists of two parts (i) the SSL part and (ii) the cryptographic library.Given the large cross-platform functionality it should not come as a surprise that the souce code documentation is not always up to date.This book is a welcome guide to OpenSSL. I guess that the vast majority of programmers developing secure programs use OpenSSL, either directly or indirectly. Without the book one has to continuously search on the Internet for code examples.In this book all aspects of OpenSSL programming are illustrated with real life C examples. I have downloaded the source code of quite a number and I found them extremely helpful.The OpenSSL package has also a number of utilities that can be run from the command line. This books describes it and gives some real examples. I have tried them all successfully.The book describes SSL/TLS programming, symmetric encryption (low-level and intermediate level), Hashes/MACS, and Public Key cryptography.I think reading this book, together with Cryptography Engineering: Design Principles and Practical Applications will end your status as a cryptography amateur.

I purchased this book in an effort to quickly get up speed with creating self-signed certificates for both client and server. I was able to use examples in this book to do so. I found the examples I needed, executed them as specified in the book and was able to create working self-signed certificates. So for the usage model that I had for this book, it delivered.

My title says it all. If you are a programmer who needs to use OpenSSL in a custom client/server application, then get this book. The code examples and corresponding text make perfect sense. The authors also go to great trouble to make sure you know the correct way in which to use the OpenSSL package. The book also covers using the openssl command-line utility. If you've ever pulled your hair out trying to understand how to use OpenSSL or have read the VERY incomplete documentation, then buy this book and have all your questions answered.

Good source of info about security.

Too in depth for me, but if SSL is something you MUST know about, this book will help you.

It's a good "basic" book. But, it's kind of out-of-date in this day and age.