I am a project manager and is touching on an IT project consisting of the usual 3 tier - web/client - middleware - database.
In this case, I have an web server and needs to implement SSL certification. Though this is not in my scope, but I felt understanding the entire process will be beneficial to everybody.
I understand symmetric and public key encryption concept.
I understand digital signature concept.
But I can't place the whole picture together. Hence, please excuse me for the lengthy post.
Here it goes,
The whole reason of HTTP/SSL certification, if I am not wrong is for 2 purposes
- encryption (so data between client and webserver are secured)
- authentication (so that "abc.com" is indeed "abc.com")
In order to proof "abc.com" is "abc.com", "abc.com" have to apply for a certificate from a Certificate Authority - which will do background checks etc. before issuing the certificate.
The certificate is then signed by CA.
Over here, since the certificate is digitally signed by the CA. So I believe, two things will be sent to the client when the client access the browser
- the certificate itself
- hash and digital signature of the certificate.
- Since the certificate is signed by the CA (e.g. Verisign), it is encrypted by its private key. So where do I obtain Verisign public key?
- Assuming the public key is obtained, the digital signature is then decrypted and the hash value matched with the hash value of the certificate,
The public key inside the certificate (which belongs to the "abc.com") will then be used by the client to encrypt its data to be sent to "abc.com".
- This "data" is actually part of a negotiation between the client and the webserver for the use of a symmetric key use for subsequent communication.
Once the symmetric key is established on both sides, subsequent communication will be encrypted using that symmetric key and not the public key inside the cert.
Am I getting this on the high level or am I totally way off?
Thinking back, When we create self-signed cert, how do we "pass" the public key to the client or whoever that is accessing the to our website ? if the public key of the signature is not given to the client -> is this the scenario whereby a popup will appear on the client browser and ask whether "to trust" the website ?