Acronyms
SSL | Secure Sockets Layer |
TLS | Transport Layer Security |
PKI | Public Key Infrastructure |
CA | Certificate Authority |
HTTPS | Hyper Text Transfer Protocol Secure |
HTTP | Hyper Text Transfer Protocol |
PCI DSS | The Payment Card Industry Data Security Standard is an information security standard used to handle credit cards from major card brands. |
SSL/TLS Certificate?
An SSL/TLS certificate is a digital object/certificate that allows multiple systems to validate the authenticity, verify the identity, and subsequently establish an encrypted network connection between them using the Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocol.
What does an SSL/TLS Certificate have?
Domain name.
Certificate authority.
Certificate authority's digital signature.
Issuance date.
Expiration date.
Public Key (Used to encrypt the message and send it via a secure channel).
SSL/TLS version.
Example
A user opens a browser, types the name of a website like www.google.com in the address bar and hits enter.
When this action happens, the browser communicates with the Google web servers via an SSL/TLS channel.
The browser attempts to verify the authenticity of the Google web servers by requesting information that is familiar or identifiable.
As a reply, the web server sends the SSL/TLS certificate which contains a public key, to the browser.
The browser validates the SSL/TLS certificate and only when it satisfies, uses the public key to send an encrypted message to the web server that contains a secret session key.
Now, the Google web server uses its private key to decrypt the message and retrieve the session key. Using the session key, the web server encrypts the message and sends an acknowledgment to the browser.
After receiving the response, both the web server and browser switch to the same session key to exchange the messages safely.
What is a session key?
A session key is a temporary key that is used to encrypt or decrypt the data between the browser and the web server, during a single online session. It is also known as a session ID or session token.
Role of a session key
Session keys play a crucial role in identity verification by maintaining stateful communication between the browser and the web server. They act as a protective layer by ensuring the data exchange in a given session is encrypted and secured from external threats such as hacking or any malware attacks.
The session key is a cipher key for symmetric cryptography. Symmetric cryptography uses the same key for encryption and decryption. Asymmetric cryptography takes up immense computing resources, that's why the web server switches to symmetric cryptography which requires less computing resources to maintain the SSL/TLS connection.
SSL/TLS certificate Facts
SSL/TLS certificates are not perpetual. They need to be renewed periodically, such as once every year or two years.
SSL/TLS certificates are issued by a trusted third party, known as a Certificate Authority (CA).
Browsers trust the certificates that come from an organization, only when this organization is on the browser's list of trusted CAs.
Since the browser trusts the certificate authority (CA), now the browser also trusts the certificate authority organization's identity.
Why are SSL certificates important?
Higher ranking in Search and SEO.
Improves user experience.
Security from attacks and hacking.
Types of SSL/TLS certificates
SSL/TLS certificates with different levels of validation are as follows,
Extended validation certificates.
Organization validated certificates.
Domain-validated certificates.
SSL/TLS certificates that support different domains are as follows,
Single domain SSL/TLS certificates.
Multi-domain SSL/TLS certificates.
Wildcard SSL/TLS certificates.
SSL/TLS handshake
The SSL/TLS handshake is a cryptographic process that establishes a secure connection between a user's browser (client) and the web server. There are a series of events that happen between the two parties in order for a successful connection.
Authenticate each other by exchanging the certificates.
Agree on the encryption standards.
Establish a secure connection between each other to exchange data.
Comments