This question already has an answer here:
- How does SSL/TLS work? 3 answers
I am trying to understand how SSL uses PKI and Digital Signature authentication to ensure secure and verified communications. I've read various sources online and from what I can tell the basic process is:
- A Server is given a Certificate from a Certificate Authority (CA). This Certificate includes (at minimum) the Public Key of the Server and a Digital Signature. The Digital Signature is some 'token' data encrypted with the CA's Private Key.
- The Server sends data to a Client. It also sends the Digital Signature with it.
- The Client checks that this CA is trusted by looking for it in a hard-coded list of CAs on the local system.
- The Client can verify this Digital Signature by decrypting it using the CA's Public Key and checking for the original 'token' data. The Client now knows that the Server is trustworthy, according to the CA.
- The Client sends data to the Server, encrypted by the Server's Public Key and an algorithm e.g. RSA.
- The Server decrypts the data using it's Private Key.
I would like to know if this understanding is correct from a high-level, and if not, what have I got wrong/missed? Or any sources I should read elsewhere that will help.