dedicated ssl certificate คือ

Dedicated SSL Certificate

Dedicated SSL Certificate คือ TLS HTTPS DV OV EV Wildcard SAN Dedicated IP CA DigiCert Sectigo Let's Encrypt Nginx Apache

Installation Guide

# === SSL Certificate Installation ===

# Step 1: Generate CSR
# openssl req -new -newkey rsa:2048 -nodes \
#   -keyout /etc/ssl/private/server.key \
#   -out /etc/ssl/certs/server.csr \
#   -subj "/C=TH/ST=Bangkok/L=Bangkok/O=MyCompany/CN=example.com"
#
# Step 2: Verify CSR
# openssl req -text -noout -verify -in server.csr
#
# Step 3: Install on Nginx
# server {
#   listen 443 ssl http2;
#   server_name example.com;
#   ssl_certificate /etc/ssl/certs/domain.crt;
#   ssl_certificate_key /etc/ssl/private/server.key;
#   ssl_protocols TLSv1.2 TLSv1.3;
#   ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
#   ssl_prefer_server_ciphers on;
#   ssl_stapling on;
#   ssl_stapling_verify on;
#   add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
# }
#
# Step 4: Test
# openssl s_client -connect example.com:443 -servername example.com
# curl -vI https://example.com

from dataclasses import dataclass

@dataclass
class InstallStep:
    step: str
    command: str
    verify: str
    common_error: str

steps = [
    InstallStep("Generate Private Key + CSR",
        "openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr",
        "openssl req -text -noout -verify -in server.csr",
        "Wrong CN (Common Name) ต้องตรงกับ Domain"),
    InstallStep("Submit CSR to CA",
        "Copy CSR content → Paste in CA website → Choose DV/OV/EV",
        "CA sends validation email or DNS challenge",
        "Email ไม่ถึง → ตรวจ Whois Email / ใช้ DNS Challenge"),
    InstallStep("Download Certificate",
        "Download .crt + .ca-bundle from CA",
        "openssl x509 -text -noout -in domain.crt",
        "Chain ไม่ครบ → รวม Intermediate CA ด้วย cat domain.crt ca-bundle.crt > fullchain.crt"),
    InstallStep("Install on Web Server",
        "Copy files → Edit Nginx/Apache config → Reload",
        "nginx -t && systemctl reload nginx",
        "Permission denied → chmod 600 key, chmod 644 crt"),
    InstallStep("Test SSL Configuration",
        "ssllabs.com/ssltest → ต้องได้ A+",
        "openssl s_client -connect domain.com:443",
        "Grade B/C → ปิด TLS 1.0/1.1 ใช้ Strong Ciphers"),
]

print("=== Installation Steps ===")
for s in steps:
    print(f"  [{s.step}]")
    print(f"    Command: {s.command}")
    print(f"    Verify: {s.verify}")
    print(f"    Common Error: {s.common_error}")

CA Comparison

# === Certificate Authority Comparison ===

@dataclass
class CAInfo:
    ca: str
    types: str
    price_range: str
    warranty: str
    best_for: str

cas = [
    CAInfo("Let's Encrypt",
        "DV Only (Wildcard supported)",
        "ฟรี (Auto-renew 90 วัน)",
        "ไม่มี Warranty",
        "Blog เว็บส่วนตัว Startup DevOps Auto-SSL"),
    CAInfo("DigiCert",
        "DV OV EV Wildcard SAN Code Signing",
        "$200-2,000/ปี",
        "สูงสุด $2,000,000 (EV)",
        "Enterprise E-commerce ธนาคาร Healthcare"),
    CAInfo("Sectigo (Comodo)",
        "DV OV EV Wildcard SAN",
        "$10-500/ปี",
        "สูงสุด $1,750,000 (EV)",
        "SME Corporate ราคาคุ้มค่า"),
    CAInfo("GlobalSign",
        "DV OV EV Wildcard Document Signing",
        "$200-1,500/ปี",
        "สูงสุด $1,500,000 (EV)",
        "Enterprise Government IoT"),
    CAInfo("GoDaddy",
        "DV OV SAN",
        "$50-300/ปี",
        "สูงสุด $1,000,000",
        "SME ที่ใช้ GoDaddy Hosting"),
]

print("=== CA Comparison ===")
for c in cas:
    print(f"  [{c.ca}] Types: {c.types}")
    print(f"    Price: {c.price_range}")
    print(f"    Warranty: {c.warranty}")
    print(f"    Best for: {c.best_for}")

Security Hardening

# === SSL/TLS Security Checklist ===

@dataclass
class SecurityCheck:
    check: str
    config: str
    impact: str
    grade_impact: str

checks = [
    SecurityCheck("TLS 1.2+ Only",
        "ssl_protocols TLSv1.2 TLSv1.3;",
        "ป้องกัน POODLE BEAST Attack",
        "ต้องมี สำหรับ Grade A"),
    SecurityCheck("Strong Ciphers",
        "ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:...;",
        "ป้องกัน Weak Cipher Attack",
        "ต้องมี สำหรับ Grade A"),
    SecurityCheck("HSTS Header",
        "Strict-Transport-Security max-age=63072000; includeSubDomains; preload",
        "บังคับ HTTPS ป้องกัน Downgrade Attack",
        "จำเป็น สำหรับ Grade A+"),
    SecurityCheck("OCSP Stapling",
        "ssl_stapling on; ssl_stapling_verify on;",
        "เร่ง Certificate Validation ลด Latency",
        "แนะนำ เพิ่ม Performance"),
    SecurityCheck("CAA DNS Record",
        "example.com CAA 0 issue 'letsencrypt.org'",
        "กำหนด CA ที่อนุญาต ป้องกัน Mis-issuance",
        "แนะนำ เพิ่ม Security"),
    SecurityCheck("Certificate Transparency",
        "ตรวจ Certificate อยู่ใน CT Log (crt.sh)",
        "ตรวจจับ Certificate ปลอม",
        "อัตโนมัติ (CA ทำให้)"),
    SecurityCheck("Key Size RSA 2048+ / ECC P-256",
        "openssl req -newkey rsa:2048 หรือ ec:secp256r1",
        "Brute-force ไม่ได้ใน 100 ปี",
        "ต้องมี RSA < 2048 จะ Fail"),
]

print("=== Security Checklist ===")
for c in checks:
    print(f"  [{c.check}]")
    print(f"    Config: {c.config}")
    print(f"    Impact: {c.impact}")
    print(f"    Grade: {c.grade_impact}")

เคล็ดลับ

• Let's Encrypt: ใช้ Let's Encrypt ฟรี สำหรับ Blog เว็บทั่วไป Auto-renew
• HSTS: เปิด HSTS ทุกเว็บ บังคับ HTTPS ป้องกัน Downgrade
• TLS 1.3: เปิด TLS 1.3 เร็วกว่า ปลอดภัยกว่า TLS 1.2
• Monitor: ตั้ง Alert ก่อน Certificate หมดอายุ 30 วัน
• SSL Labs: ทดสอบ ssllabs.com/ssltest ต้องได้ Grade A+

Dedicated SSL Certificate คืออะไร

SSL/TLS เฉพาะโดเมน Dedicated IP DV OV EV Wildcard SAN Shared vs Dedicated CA Trust HTTPS Encryption Browser

สรุป

Dedicated SSL Certificate TLS HTTPS DV OV EV Wildcard CA DigiCert Let's Encrypt Nginx HSTS OCSP Grade A+ Security Production