I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my understanding is wrong.

1. When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be used.

2. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key

3. But first, the authenticity of the webserver must be confirmed. Hence, the webserver send the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).

4. This digital certification is being issued by the Certificate Authority which will does checks and verification to prove that the webserver/domain does really belongs to whom it is suppose to be long to.

5. *However again, how do we prove the authenticity and integrity of the digital certification? For integrity, the digital certificate is hashed and send together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA private key.

6. *So if the digital certificate is signed by the CA private key, how do we get CA's public key? The overall idea I have is that public keys from CA are preinstalled in many browsers.

7. With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certificate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.

8. With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.

9. With the symmetric key being know and created on both place. Encrypted communication can begin.

Questions:

• Is my understanding correct?

• for 2* is the session key created by the web client and send to the webserver for use directly (encrypted) or it is setup by exchanging information that end up having both side with the same session key (Diff hellman algorithm?)

• For 5* I have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate  ? or it just issue a digitally signed hash of the certificate.

• Else,how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key?

• For 6* is my understand correct that CA's public key come preinstalled with the browsers?

• Does the client need to authenticate with the webserver? (I read about having the client sending cert to the webserver as well).

• What will be put in the truststore on the webclient, and what will be put in the keystore on the webserver?

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my understanding is wrong.

1. When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be used.

2. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key.

3. But first, the authenticity of the webserver must be confirmed. Hence, the webserver sends the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).

4. This digital certification is being issued by the Certificate Authority which checks and verifies to prove that the webserver/domain does really belong to whom it is suppose to belong to.

5. *However again, how do we prove the authenticity and integrity of the digital certification? For integrity, the digital certificate is hashed and sent together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA's private key.

6. *So if the digital certificate is signed by the CA's private key, how do we get CA's public key? The overall idea I have is that public keys from CA are preinstalled in many browsers.

7. With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certificate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.

8. With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.

9. With the symmetric key being known and created on both sides, encrypted communication can begin.

Questions:

• Is my understanding correct?

• For 2*, is the session key created by the web client and sent to the webserver for use directly (encrypted) or is it setup by exchanging information that end up having both sides with the same session key (Diffie Hellman algorithm?)?

• For 5,* I have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate? Or does it just issue a digitally signed hash of the certificate.

• Else, how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key?

• For 6*, is my understand correct that CA's public key come preinstalled with the browsers?

• Does the client need to authenticate with the webserver? (I read about having the client sending cert to the webserver as well).

• What will be put in the truststore on the webclient, and what will be put in the keystore on the webserver?

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense.

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my understanding is wrong.

1. When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be use.

2. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key

3. But 1st, the authenticity of the webserver must be confirmed. Hence, the webserver send the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).

4. This digital certification is being issued by the Certificate Authority which will does checks and verification to prove that the webserver/domain does really belongs to whom it is suppose to be long to.

5. *However again, how do we prove the authenticity and integrity of the digital certification  ? For integrity, the digital certificate is hashed and send together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA private key.

6. *So if the digital certificate is signed by the CA private key, how do we get CA's public key  ? The overall idea i have is that public keys from CA are preinstalled in many browsers.

7. With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certifcate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.

8. With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.

9. With the symmetric key being know and created on both place. Encrypted communication can begin.

Questions:

• Is my understanding correct  ?

• for 2* is the session key created by the web client and send to the webserver for use directly (encrypted) or it is setup by exchanging information that end up having both side with the same session key (Diff hellman algorithm  ?)

• For 5* I have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate ? or it just issue a digitally signed hash of the certificate.

• Else,how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key  ?

• For 6* is my understand correct that CA's public key come preinstalled with the browsers  ?

• Does the client need to authenticate with the webserver  ? (i read about having the client sending cert to the webserver as well).

• What will be put in the truststore on the webclient, and what will be put in the keystore on the webserver  ?

Regards,

I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my understanding is wrong.

1. When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be used.

2. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key

3. But first, the authenticity of the webserver must be confirmed. Hence, the webserver send the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).

4. This digital certification is being issued by the Certificate Authority which will does checks and verification to prove that the webserver/domain does really belongs to whom it is suppose to be long to.

5. *However again, how do we prove the authenticity and integrity of the digital certification? For integrity, the digital certificate is hashed and send together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA private key.

6. *So if the digital certificate is signed by the CA private key, how do we get CA's public key? The overall idea I have is that public keys from CA are preinstalled in many browsers.

7. With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certificate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.

8. With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.

9. With the symmetric key being know and created on both place. Encrypted communication can begin.

Questions:

• Is my understanding correct?

• for 2* is the session key created by the web client and send to the webserver for use directly (encrypted) or it is setup by exchanging information that end up having both side with the same session key (Diff hellman algorithm?)

• For 5* I have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate ? or it just issue a digitally signed hash of the certificate.

• Else,how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key?

• For 6* is my understand correct that CA's public key come preinstalled with the browsers?

• Does the client need to authenticate with the webserver? (I read about having the client sending cert to the webserver as well).

• What will be put in the truststore on the webclient, and what will be put in the keystore on the webserver?

1. When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be use.

*2) In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key

3. But 1st, the authenticity of the webserver must be confirmed. Hence, the webserver send the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).

4. This digital certification is being issued by the Certificate Authority which will does checks and verification to prove that the webserver/domain does really belongs to whom it is suppose to be long to.

*5) However again, how do we prove the authenticity and integrity of the digital certification ? For integrity, the digital certificate is hashed and send together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA private key.

*6) So if the digital certificate is signed by the CA private key, how do we get CA's public key ? The overall idea i have is that public keys from CA are preinstalled in many browsers.

===================================================================

7. With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certifcate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.

8. With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.

9. With the symmetric key being know and created on both place. Encrypted communication can begin.

========================================= q1) is my understanding correct ?

q2) for 2*) is the session key created by the web client and send to the webserver for use directly (encrypted) or it is setup by exchanging information that end up having both side with the same session key (Diff hellman algorithm ?)

for *5) i have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate ? or it just issue a digitally signed hash of the certificate.

Else,how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key ?

6*) is my understand correct that CA's public key come preinstalled with the browsers ?

q3) does the client need to authenticate with the webserver ? (i read about having the client sending cert to the webserver as well).

q4) what will be put in the truststore on the webclient, and what will be put in the keystore on the webserver ?

Sorry for the length post.

Regards, Noob

1. When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be use.

2. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key

3. But 1st, the authenticity of the webserver must be confirmed. Hence, the webserver send the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).

4. This digital certification is being issued by the Certificate Authority which will does checks and verification to prove that the webserver/domain does really belongs to whom it is suppose to be long to.

5. *However again, how do we prove the authenticity and integrity of the digital certification ? For integrity, the digital certificate is hashed and send together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA private key.

6. *So if the digital certificate is signed by the CA private key, how do we get CA's public key ? The overall idea i have is that public keys from CA are preinstalled in many browsers.

7. With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certifcate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.

8. With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.

9. With the symmetric key being know and created on both place. Encrypted communication can begin.

Questions:

• Is my understanding correct ?

• for 2* is the session key created by the web client and send to the webserver for use directly (encrypted) or it is setup by exchanging information that end up having both side with the same session key (Diff hellman algorithm ?)

• For 5* I have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate ? or it just issue a digitally signed hash of the certificate.

• Else,how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key ?

• For 6* is my understand correct that CA's public key come preinstalled with the browsers ?

• Does the client need to authenticate with the webserver ? (i read about having the client sending cert to the webserver as well).

• What will be put in the truststore on the webclient, and what will be put in the keystore on the webserver ?

Regards,