SSL Certificate Definition

A definition of secure socket layer and certificates for creating secure connections and providing authentication to clients.

Secure socket layer (SSL) is a protocol for encrypting and sending data in a secure manner between two destinations. SSL also plays an important role in validating the identity of websites using certificates. An SSL certificate tells the user that a website is authentic, and that this fact has been validated by a third-party certificate authority.

How It Works

Both source and destination have their own private and public keys for encrypting and decrypting the sent messages. Interaction starts with both sides acknowledging the other and signaling that the session is to be started in SSL. Packets are sent through port 443, which is the assigned SSL application port. The website sends its certificate which the user's browser checks against a certificate authority (CA) and uses the appropriate public key to validate the certificate. The user's browser sends back a pre-master key encrypted with the website's public key, which the website will decrypt with its private key. Both sides use the pre-master key and random numbers passed during transmissions to compute a secret key, which will be used to decrypt messages in the secure connection.

Certificates

SSL certificates were created for websites to create a trusted connection to users. A user who receives a certificate from a website they are doing transactions with can be assured that the website is authentic and not an impostor. Most browsers will warn users if they are using a website without a valid certificate, as this could indicate that the website might be an impostor or is insecurely handling important information.

Handshakes

The SSL certificate is an important component of the SSL handshake. Without the certificate, a client cannot validate the server and find their public key, which is a required component of the handshake system. Only certificate authorities can be queried for a certificate's public key, which is necessary to validate the certificate. Only after a certificate has been verified with an authentic public key can the handshake continue to produce secret keys for the secure session.

Who Uses Certificates?

Any website wishing to engage in e-commerce transactions should be wise to use SSL certificates. Credit card numbers and other important personal data should be kept secure and secret during transmissions. Websites that provide personal information like government agencies and educational institutions should use certificates as well.

Developed by Netscape

Secure socket layer was originally developed by Netscape as a possible solution to the growing problem of security on the Internet. Netscape's goal had been to develop an OS (operating system) independent system for creating encrypted data paths between a client and a server.

References

• Extended Validation SSL Certificate: History of SSL
• Blue Reef: Secure Socket Layers