Secure Socket Layer(SSL) and Certificates.
The Secure socket layer(SSL) protocol was created by Netscape to make sure secured transaction between the server and the client(browsers).The third party Certificate authority(CA) plays role here in identifying one or both ends of transactions.
Lets see how it works :
- Browser requests for a secure page (using https://)
- The webServer sends it a public key with its certificate.
- The browser will first check that the certificate was issued by a trusted party.
- Its validity and does it relates to the requested site.
- The browser then uses the public key to encrypt the random symmetric encryption key and sends it back to the server with the url and Http data in encrypted format.
- The webserver then decrypts the symmetric encryption key with its private key and uses the Symmetric key to decrypt the URl and HTTP data.
- The Webserver sends back the HTML document and the HTTP encrypted data with symmetric key
- Browser decrypts the data and HTML document using symmetric and displays the web content.
You may not be familier with the terms Public keys and Prviate keys.Just see the following dig.
Message–>[Public Key]–>Encrypted Message–>[Private Key]–>Message
SSL Certificates.
When we communicate over the network how would we know to whom we are communicating or are we dealing with the right website.
There is a third party who guarantees about such websites that the website owner are the persons who the claim for. We have to trust this third party and we have to load a certificate in our browser a ROOT Certificate. This certificate includes the owner credentials such as email id, name, certificate usage, resource location, certificate validity and certificate ID of the person who signs this information. With all this information it also contains a public key and HASH at the end which ensure that the certificate is not tampered. As we have made mind to trust the third party we also trust the certificate. This is certificate Path.We have a certificate loaded of a well known Certificate Authority(CA). The CA is responsible to maintain the list of all signed and revoked certificates. A signed certificates cannot be modified and is secure.
