6

Does browsers use one-way or two-way SSL/TLS when I browse to a https address?

  • 1
    Note that in "one-way" SSL/TLS, information is still encrypted in both direction. – Tom Mar 8 '17 at 10:51
7

Typically you are using one-way SSL/TLS because your browser is checking the certificate of the server but the server is not checking for a client certificate pre-installed in your browser.

When using mutual authentication the browser verifies the server's certificate just like a typical one-way connection but an additional step is involved where the server verifies that the client has a certificate which allows them to access this system. This is not common and requires you to install a client certificate.

The browser can do both easily but if an additional certificate was not installed the authentication is probably only one way (authentication of the server). In both cases, all traffic is encrypted in both directions the one-way or two-way part just refers to the authentication components.

  • Good answer (+1), I would highlight that the "browser can do both easily" is technically true but the user interaction is very dependent on the browser. The client-side check always triggers a pop-up which content is completely dependent on the browser. The user may end up with a long list of all possible certs to offer the server, or only one, or only some that match the server request (for one single server). – WoJ Mar 8 '17 at 6:51
  • 1
    ('contd) This is one of the reasons the adoption is low - you basically need to tell your users that depending on the browser they may or may not be able to (easily /realistically) pick the right get to offer to the requesting server – WoJ Mar 8 '17 at 6:51
  • @WoJ It's not widely adopted because for Internet purposes the server wants everyone to be able to access their content. Two-way TLS is more likely in a private corporate network to ensure only the authenticated users can browse the network. – RoraΖ Mar 8 '17 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.