1. A browser or
server attempts to connect to a Website. Web server, secured with SSL.
2. The
browser/server requests that the Web server identify itself.
- The
Web server sends the browser/server a copy of its SSL certificate and
Public Key
4. Web Brower has
list of trusted certificate authorities
5. Web server responds
by sending a certificate. Server responds by sending a copy of its SSL Certificate, including the server's
public key.
6. Web browser
checks the certificate and verify whether the certificate is issued by one of
it’s trusted security certificate authorities.
- The
browser/server checks to see whether or not it trusts the SSL certificate.
If so, it sends a message to the Web server.
- The
Web server sends back a digitally signed acknowledgement to start an SSL
encrypted session.
- Encrypted
data is shared between the browser/server and the Web server.
10. If everything are
fine, then browser generates a random symmetric key
11. Then use the
Public Key shared by the SSL to encrypt the data. The session key is used to encrypt all transmitted data after the secure connection is made,
12. Web server
decrypt the data using the it’s own Private key
Comments