How Does SSL Work?
• When accessing an SSL-secured Web site, the user’s browser sends a message to the Web server, requesting a secure session. • The Web server responds by sending the user its server certificate (which includes its public key). • The user’s browser will verify that the server’s certificate is valid and has been signed by a certificate authority whose certificate is in the browser’s database. It will also verify that the certificate authority certificate has not expired. • If the certificates are all valid, the user’s browser will generate a one-time, unique “session” key and encrypt it with the server’s public key. The user’s browser will then send the encrypted session key to the server so that they will both have a copy. • The server will decrypt the message using its private key and recover the session key. This completes the SSL “handshake” process, and a secure SSL connection has been established. The entire process of establishing the SSL connection typically happens transparently
and Who are the certificate authorities? How does SSL work? Okay, we know what SSL is and what it does, but how actually does it work? Although the process may seem complicated at first, these processes take place in a split second, involving no human interaction whatsoever. Before we go forward, understand what an SSL enabled web server is. An SSL web server is one that has had its identity confirmed. A certificate authority will provide that web server with identification (like a driver’s license). You, the client, ask for identification before sending any data, making sure the channel is secure and that we are doing business with a properly authenticated web site (and company). This is analogous to your driver’s license. The DMV issues you a driver’s license which you use for identification. When a hotel clerk asks for your driver’s license, he or she is demanding proper identification before the transaction. This is xactly what takes place between you, the user, and the SSL enabled
Secure Sockets Layer uses a cryptographic system that encrypts data with two keys. When a SSL Digital Certificate is installed on a web site, users can see a padlock icon at the bottom area of the navigator. When an Extended Validation Certificates is installed on a web site, users with the latest versions of Firefox, Internet Explorer or Opera will see the green address bar at the URL area of the navigator. Users on sites with SSL Certificates will also see https:// in the address bar during an ecommerce transaction.
Quick SSL Fact: Getting your own SSL certificate usually requires some coordination with your web host. A “certificate signing request” needs to be generated on your hosting server. This is normally done by the hosting company staff. How does SSL work? Quick SSL Fact 2: Using an SSL certificate on your account requires the hosting account to have it’s own IP address. Many hosting companies charge extra for this or only have IP addresses included in their higher packages. If you plan to use your own SSL certificate be sure your hosting package includes an IP address. (see our our hosting recommendations) Shared SSL Certificates: Some web site hosting companies have “shared” SSL certificates available. Using shared SSL certificates can be a good alternative to having your own. They can usually be easily integrated into your shopping cart and can save site owners the expense and effort of getting their own certificates. For more information on shared SSL certificates click here. SSL web s
