The key to secure transmission: TLS in the Raygun ecosystem

As our lives increasingly move online and data becomes the lifeblood of business, secure data transmission is imperative.

From personal conversations to financial transactions, from healthcare records to sensitive business data, nearly everything we do online requires trust that our data is protected. And if you've ever made an HTTPS request, TLS is behind it, providing that trust.

Transport Layer Security (TLS) is a crucial protocol for establishing online safety. Its function is to secure the information we transmit online, ensuring that it arrives safely at its intended destination. In essence, TLS provides a secure foundation for our online activities, creating a robust pathway for our data as it navigates the vast networks of the internet.

In this blog post, we explore TLS, a cornerstone of secure data handling, and its pivotal role in Raygun's error and performance monitoring solutions. We'll demystify the implementation of TLS in our Raygun4Net provider and address some common pitfalls developers may come across when working with this technology.

What is TLS?

Transport Layer Security, or TLS, is a cryptographic protocol that underpins secure network communications. It establishes a secure connection through a process known as the 'TLS handshake,' facilitating confidentiality and data integrity. Though sometimes referred to interchangeably with its predecessor, the Secure Socket Layer (SSL), TLS has replaced SSL due to the latter's vulnerabilities.

At the heart of TLS is the concept of encryption, which converts readable data (plaintext) into an unreadable format (ciphertext), and its counterpart, decryption, which reverts the data back to its original, readable form. This transformation is executed using complex mathematical algorithms and unique keys, ensuring that only the intended recipients can decipher the transmitted data.

In essence, TLS is the unseen shield that safeguards your data as it travels through the vast network of the internet. Its role in maintaining confidentiality and ensuring data integrity is integral to secure online communications, including those within the operations of Raygun (which we'll delve into next).

How TLS works

TLS functions by leveraging a process known as the 'TLS handshake'. This ensures that both the client and the server can verify each other's identity, agreeing upon an encryption method and a unique session key for the subsequent secure data transmission.

TLS handshake graphic

  1. ClientHello: The client starts the handshake by sending a "ClientHello" message to the server. This message includes information such as the TLS version being used, the cipher suites supported by the client, and a random string of bytes known as the "client random."

  2. ServerHello: In response to the "ClientHello," the server sends back a "ServerHello" message containing the chosen cipher suite, the "server random" byte string, and the server's certificate. The certificate contains the server's public key and is signed by a trusted Certificate Authority (CA).

  3. Verification of the Server's Certificate: The client verifies the server's certificate against a list of trusted CAs. If the certificate is valid, the client uses the public key from the server's certificate to encrypt a new random byte string, the "premaster secret," and sends it to the server.

  4. Decryption and Key Derivation: The server uses its private key to decrypt the premaster secret. Both the client and server now have the same premaster secret, but it's not used as the session key. Instead, both the client and the server use the premaster secret and the random byte strings previously exchanged to generate the session keys for encryption and decryption.

  5. Secure Communication: Once the keys are generated, both the client and server exchange messages to confirm that the rest of the communication will be encrypted using the agreed cipher and keys. They can now exchange data securely.

It's important to note that TLS not only provides encryption, but also allows the server and client to authenticate each other. It ensures that the data hasn't been tampered with during transmission by using a Message Authentication Code (MAC). In addition, the protocol protects against replay attacks by using unique sequence numbers for each packet.

This underlying process of TLS plays a vital role in safeguarding against unauthorized access, thus ensuring secure communication over the internet. The practical application of this process can be seen in how TLS is implemented within Raygun's ecosystem.

TLS requirements for Raygun

As a leading provider of error and performance monitoring, Raygun is entrusted with a significant amount of customer data. This data, often sensitive and crucial for our customers' operations, requires top-tier security measures to ensure its protection. This is where TLS comes into play, meeting the stringent demands required by Raygun's security standards.

Raygun's services involve collecting, processing, and storing a broad spectrum of data, including application performance data, error logs, user behavior data, and more. Ensuring the confidentiality, integrity, and availability of this data is a critical priority. Not only does the data represent valuable insights for our customers, but it's also an asset that, if compromised, could impact our customers' operations and their users' experience, not to mention Raygun's integrity. TLS provides the robust encryption necessary to protect this data during transmission, preventing unauthorized access and alteration.

In our ongoing mission to provide airtight security at Raygun, we've been making some noteworthy changes. We've boosted our ingestion nodes to operate with TLS 1.2 and 1.3, the most up-to-date and secure versions of the protocol. And as we're welcoming these upgrades, we're formulating a plan to start phasing out TLS 1.1. We're committed to meeting the highest standards of security to provide assurances to our customers, and by extension to their customers, that all data is totally secured.

Implementing TLS support for Raygun4Net

As we've recently upgraded our ingestion pipeline to require TLS 1.1, 1.2, or 1.3, this has introduced a bit of a challenge for some customers. By default, on .NET versions lower than 4.5.1, .NET doesn't automatically pick up the latest safe TLS defaults. This, unfortunately, means that some old applications that try to send requests using a deprecated TLS version get rejected by our network infrastructure.

We don't like the idea of forcing customers to make changes to their codebase. That's why we put our thinking caps on to find a workaround, which led to us making changes to our Raygun4Net provider.

In practice, this means we've tweaked our provider to adaptively switch to the correct TLS version just as the message is ready to be sent out. Plus, we've made sure to remember the original TLS version so we can neatly switch it back once your message is safely on its way.

However, there's a tiny catch. For technical reasons, our TLS-switching algorithm doesn't work for .NET 3.5 or lower. So, if you're using these older versions of the framework, you'll still need to manually implement the workaround so that your operating system supports one of our required TLS versions.

Rest assured, developers working with other languages and frameworks are in the clear. Most technologies default to the highest mutually supported TLS version, circumventing the need for any updates to their provider.

Common pitfalls around TLS

When maintaining a secure security posture, developers often run into challenges and stumbling blocks. For us, a big one was rolling out a breaking change for our customers. It's something that software teams try to avoid, as it goes against the 'Principle of Least Astonishment' — the idea that software should behave in a way that surprises users the least. However, in our case, we saw it as a necessary step.

Updating for TLS is full of challenges developers will need to consider as they improve the security of their software and services.

Let's explore some of these issues to better understand how to avoid them:

  1. Outdated TLS Version: One of the most common mistakes is using outdated versions of TLS. Earlier versions, such as TLS 1.0 and 1.1, have known vulnerabilities that make them less secure. Always ensure you're using the latest stable release, currently TLS 1.3, to benefit from the most robust security features.

  2. Misconfiguration: TLS offers a plethora of configuration options, which can be both a strength and a weakness. Improperly configured TLS can lead to vulnerabilities, making it easier for attackers to compromise the data. It's vital to follow best practices when configuring your TLS settings.

  3. Certificate Management Issues: Certificates validate the identity of the server to the client. However, poor certificate management, like using self-signed certificates or failing to renew certificates before they expire, can lead to security warnings or even blocked connections.

  4. Insufficient Cipher Suites: Cipher suites determine how encryption is handled in TLS. Using deprecated or weak cipher suites can expose your data to unnecessary risks. Be sure to select strong cipher suites and regularly update your choices as cryptographic standards evolve.

  5. Not Enforcing HTTPS: HTTPS, which stands for HTTP over TLS, should be enforced for all connections to ensure data security. Without HTTPS, data sent over the network could be intercepted and read by attackers.

  6. Ignoring Perfect Forward Secrecy (PFS): PFS ensures that even if a session key is compromised, past session keys remain secure. Ignoring PFS could mean that if an attacker gets hold of a single session key, they could potentially decrypt all past sessions.

By understanding these common pitfalls and how to avoid them, developers can more effectively leverage TLS to secure their data.

Up next, we'll be discussing what's to come for TLS at Raygun.

Conclusion

When it comes to data security, there's no room for half-measures. As the digital realm continues to grow and change, we are met with an evolving array of challenges. TLS is a mighty weapon in our arsenal against these ever-changing threats, ensuring our data travels safely across the vast reaches of the internet.

Here at Raygun, we're not just following along—we're setting the pace. Our recent upgrades to the latest and greatest TLS versions represent not just a commitment to security, but also a dedication to our customers. We understand that our role is not just about securing data; it's about building trust. And that trust is earned through actions, not just words.

We're excited about and prepared for what's on the horizon. We're ready to embrace new technologies, keep up with emerging trends, and continue enhancing our TLS implementations. And through it all, our guiding principle remains the same: providing you, our customers, with the highest level of data security possible.

Do you have any thoughts about TLS and its role in securing online communications? Get in touch with me on Twitter and let me know what you think.