SSL/TLS
SSL
Stand for Security Socket Layer Standard security protocol technology for establishing a secure connection between a web server and browser
TLS
Stand for Transport Layer Security It is the next generation of SSL
Risks in Communication
Eavesdropping
Messages can be READ by third-party
Tampering
Messages can be MODIFIED by third-party
Pretending
Users involve in the communication can be PRETENDED by third-party
Process of SSL
Client requests an SSL connection
client provides some information to server:
- supported protocol
- encryption method
Server send SSL Certificate and its public key
- also confirm the protocol and encryption method
Client verifies the public with Certificate Authority
If the certificate is with the following conditions, report warings to the user.
- not an trust by an CA
- The domain of server is different with certificate
- expired
Create the symmetric key encrypting with server's public key
Finally, both will communicate with symmetric encryption