SSL, TLS And Digital Certificates

What is TLS/SSL

Information security plays a vital role in this ever changing world of Digitization. Of course, you won't like someone keeping an eye on you or eavesdrop and try to tamper the information while you are in an important conversation with your boss or colleague or anyone for that matter.
We have seen several cases where information being manipulated by attackers using specific attacks like MITM (Man In The Middle) and lead the organization to lose confidential data.

To avoid such incidents and also keeping privacy concerns in mind, SSL(Secure Socket Layer) protocol was developed in 1995 and has been highly preferred to use to avoid any chances of getting compromised. The SSL and its successor TLS(Transport Layer Security) are both sometimes referred to as SSL. These are the cryptographic protocols used with several encryption/decryption algorithms(ciphers) to provide a secure network to communicate from one device to another. The protocol is highly recommended, if you want to secure the communication channel between the web server and your web browser.

How TLS/SSL works

To establish a secure communication channel between any two devices, both client and server has to define some rules, which is known as TLS handshake in this case. Following is the key information being exchanged by client and server to establish the secure connection....

• SSL client sends client Hello message to server , which includes SSL version details and a list of supported cipher suites.
• The server then revert with a server Hello message to client, including chosen cipher details from the list provided, Server's public key and also server's Digital certificate.
• The client then validates the server's certificate and also checks for the other cryptographic parameters.
• The client now then generate a session key, encrypt it with server's public key and send it to server. The session key is unique for each session.
• Once done, both client and server starts communicating securely.

 Digital Certificates

In the earlier section, we explained how TLS/SSL works to secure the communication. However, in a real time scenario, all this is done using Public Key certificates, also known as Digital certificates. The certificate contains information about the key, identity details of the service owner and the Digital Signature of a well known authority who has verified the content of certificate and validate the authenticity of the Service. In a typical public key Infrastructure, the authority who issues the certificates is known as Certificate Authority (eg, Symantec) or CA in short. These authorities charges users for issuing Digital certificates. The most common format used for Digital certificates is X.509 as per RFC 5280.