Please note that this is not about how SSL communication happens between browser (I researched and understood it) and client but other aspects.
Using Digicert's SSL mechanism explanation I have understood how the data is encrypted between browsers and servers. Below is my understanding.
- Browser will send a request to the server to get some resource. Server checks if the protocol of the request is HTTPS, if so then it will send its certificate (this certificate is already signed by some CA (Certificate Authority, like Digicert)) in the response.
- Browser will check if the certificate is valid by validating looking up the signing authority in its valid CA pool.
- If the browser finds that this certificate is signed by a valid CA then it generates a session key and encrypts it using the public key present in the certificate.
- Browser will send this encrypted session key to the server and server will decrypt the session key. The server will send back an acknowledgment to the browser which would be encrypted using the session key.
- Above steps complete an SSL handshake and then secure communication starts between browser and server.
Based on my above understanding:
- The browser will generate a session key and encrypt it using server's public key. But which encryption algorithm (or commonly called as cipher algorithm) will be used by the browser?
- How is cipher selection determined, and will browser and server both use the same cipher/key size for encryption and decryption?
- Once SSL handshake is completed, all communication will be encrypted using the symmetric session key, but again which encryption algorithm will be used by the browser?
- Is the encryption algorithm used by browser in any way dependent upon certificate received from server?
- Or is all encryption performed by the browser performed with the same cipher algorithm?
- Please correct me if I am wrong, the algorithm or cipher information is also present in the certificate? How does that information stored in the certificate?
- While generating the certificate do I need to state which algorithm, how many bits encryption, padding etc.?
Based on the above answer I will have the most important question - suppose I am providing my server's private key to somebody so that he can monitor the SSL traffic for my server, then apart from providing him the private key what all other things I need to take care. And do I need to tell him the algorithm or cipher I am using at server?