PHP & SSL

[KevinM1]

Over the next few weeks, I'm going to be working on a simple custom e-commerce site that will apparently be using SSL during transactions.  I know what SSL stands for, but beyond that, I'm clueless.  I also know that there's a PHP extension that deals with SSL (OpenSSL, I believe), but the spec is a bit confusing to me as I don't know the ins and outs of SSL.  Are there any resources you could direct me to that more or less explains the inner workings of SSL (things like certificates and whatnot)?

Thanks. :)

[bqallover]

This can be a very confusing area if you haven't done it before, and as someone who HAS set up a HTTPS server I *still* couldn't talk you through it off the top of my head. :)

I did it on Win2k3 and I relied heavily on the [url=http://tud.at/programm/apache-ssl-win32-howto.php3]The Apache + SSL on Win32 HOWTO[/url].  That's a bit out of date now so you might want to try [url=http://raibledesigns.com/wiki/Wiki.jsp?page=ApacheSSL]The Apache + SSL HOWTO[/url] also.

OpenSSL isn't a PHP extension.  It's an open source SSL toolkit, that among other things allows you to create public and private keys, necessary for implementing HTTPS.  You might be thinking of mod_ssl, which is an Apache extension. 

If, as you say, you're not really to grips with SSL in general, then it's pretty much essential that you ground yourself on that.  One resource is [url=http://www.cisco.com/en/US/netsol/ns340/ns394/ns50/ns140/networking_solutions_white_paper09186a0080136858.shtml]this introduction from Cisco[/url].

I'd also recommend listening to episodes 30-37 of [url=http://www.grc.com/securitynow.htm]the SecurityNow! podcast[/url], which deal with cryptography, if not totally on SSL.  That will give you a nice understanding of the underlying ideas.

Hope that helps!  Stick with it! :)