Encryption Protects Data during Transmission
Web servers and web browsers rely on the Secure Sockets Layer (SSL) protocol to help users protect their data during
transfer by creating a uniquely encrypted channel for private communications over the public Internet. Each SSL
Certificate consists of a key pair as well as verified identification information. When a web browser (or client) points
to a secured website, the server shares the public key with the client to establish an encryption method and a unique
session key. The client confirms that it recognizes and trusts the issuer of the SSL Certificate. This process is known as
the "SSL handshake" and it begins a secure session that protects message privacy, message integrity, and server
security.
How does SSL work?
1.
2.
3.
4.
A browser attempts to connect to a website secured with SSL.
The browser requests that the web server identify itself.
The server sends the browser a copy of its SSL Certificate.
The browser checks the certificate root against a list of trusted Certificate Authorities and that the certificate
is unexpired, unrevoked, and that its common name is valid for the website that it is connecting to.
5. The server sends back a digitally signed acknowledgement to start an SSL encrypted session.
6. Encrypted data is shared between the browser and the server and https appears.
What is an SSL Certificate?
SSL Certificates are small data files that digitally bind a cryptographic key to an organization’s details. When installed
on a web server, it activates the padlock and the https protocol and allows secure connections from a web server to a
browser. Typically, SSL is used to secure credit card transactions, data transfer and logins, and more recently is
becoming the norm when securing browsing of social media sites. SSL Certificates bind together:
• A domain name, server name or hostname.
• An organizational identity (i.e. company name) and location.
An organization needs to install the SSL Certificate onto its web server to initiate secure sessions with browsers.
Depending on the type of SSL Certificate applied for, the organization will need to go through differing levels of
vetting. Once installed, it is possible to connect to the website over https://www.domain.com, as this tells the server
to establish a secure connection with the browser. Once a secure connection is established, all web traffic between
the web server and the web browser will be secure. Browsers tell visitors a website is SSL secure via several visible
trust indicators:
Mr Ashraf, Sept 2016
20