How Secure Socket Layer (SSL) Certificates Work?
In our previous article on what is an SSL certificate and what it is used for , we talked about its definition and how it can be used to secure sensitive private data such as credit cards etc.
Now, we shall discuss how Secure Socket Layer (SSL) certificates works.
When a browser attempts to access a website that is secured by SSL, the browser and the web server establish an SSL connection using a process called an “SSL Handshake” A SSL Handshake is referring to a process of securing the transmission of data between the web server and the client (browser) through symmetric encryption. During this process, the "handshake" appears invisible to the end-users and takes place immediately.
Here's what is going on in step 1 to step 5 based on the diagram above:
The web browser request the server to identifies itself after it connects to a web server (website) secured with SSL (https).
The server will send a copy of its SSL Certificate, including the server’s public key.
The web browser will then check the certificate root against a list of trusted Certificate Authority (CA). It will check whether the certificate is expired, unrevoked and the common name is legitimate for the website it is trying to connect to. If the browser trusts the certificate, it creates, encrypts, and sends back a symmetric session key using the server’s public key.
The server decrypts the symmetric session key using its private key. Next, the server sends back an acknowledgement encrypted with the session key to start the encrypted session.
Server and browser now encrypt and decrypt all transmitted data with the symmetric session key. This allows for a secure channel because only the browser and the server know the symmetric session key, and the session key is only used for that specific session.
If the browser is to reconnect to the same server again (assuming in the next 12 hours or more), a new session key would be created.
Now, we shall discuss how Secure Socket Layer (SSL) certificates works.
When a browser attempts to access a website that is secured by SSL, the browser and the web server establish an SSL connection using a process called an “SSL Handshake” A SSL Handshake is referring to a process of securing the transmission of data between the web server and the client (browser) through symmetric encryption. During this process, the "handshake" appears invisible to the end-users and takes place immediately.
Here's what is going on in step 1 to step 5 based on the diagram above:
The web browser request the server to identifies itself after it connects to a web server (website) secured with SSL (https).
The server will send a copy of its SSL Certificate, including the server’s public key.
The web browser will then check the certificate root against a list of trusted Certificate Authority (CA). It will check whether the certificate is expired, unrevoked and the common name is legitimate for the website it is trying to connect to. If the browser trusts the certificate, it creates, encrypts, and sends back a symmetric session key using the server’s public key.
The server decrypts the symmetric session key using its private key. Next, the server sends back an acknowledgement encrypted with the session key to start the encrypted session.
Server and browser now encrypt and decrypt all transmitted data with the symmetric session key. This allows for a secure channel because only the browser and the server know the symmetric session key, and the session key is only used for that specific session.
If the browser is to reconnect to the same server again (assuming in the next 12 hours or more), a new session key would be created.
Updated on: 08/02/2019
Thank you!