One-Way and Mutual SSL Authentication

Application Scenario

One-way SSL authentication applies to the scenario where the client only needs to verify the server identity. For example, in website access, user identity verification is not required at the communication layer, and the application logic layer can ensure security.

The mutual SSL authentication mechanism ensures that the server and client can verify each other's identity, which is mainly used to prevent man-in-the-middle attacks and ensure communication security and reliability. This mechanism is used in scenarios that require high security, such as banks, financial services, IoT, enterprise internal services, and government services, which involve privacy information or provide services only for specific clients.

You can configure one-way or mutual authentication when creating an HTTPS listener. For details, see HTTPS Authentication Using ELB.

Working Principles

• One-way SSL authentication
  Figure 1 One-way authentication
  
  1. The client sends information, such as an SSL protocol version, type of encryption algorithm, and random number, to the server.
  2. In addition to an SSL protocol version, type of encryption algorithm, and random number, the server returns a server certificate (public key certificate) to the client.
  3. The client verifies the validity of the server SSL certificate, including whether the server certificate expires, whether the CA of the issued server certificate is reliable, whether the public key of the CA can be used to correctly decrypt the CA digital signature of the server certificate, and whether the domain name in the server certificate matches the server's domain name (that is, the domain name accessed by the user). If the verification is successful, the communication continues. Otherwise, the communication ends.
  4. The client randomly generates a symmetric encryption key, encrypts the key using the server's public key (the server's public key is obtained from the server's certificate in step 2), and sends the encrypted key to the server.
  5. Upon receiving the encrypted information from the client, the server decrypts the information with the private key to obtain the symmetric encryption key.
  6. In the subsequent session, the client and server use the symmetric encryption key to communicate with each other, ensuring information security during the communication.
• Mutual SSL authentication
  Figure 2 Mutual authentication
  
  1. The client sends information, such as an SSL protocol version, type of encryption algorithm, and random number, to the server.
  2. In addition to an SSL protocol version, type of encryption algorithm, and random number, the server returns a server certificate (public key certificate) to the client.
  3. The client verifies the validity of the server SSL certificate, including whether the server certificate expires, whether the CA of the issued server certificate is reliable, whether the public key of the CA can be used to correctly decrypt the CA digital signature of the server certificate, and whether the domain name in the server certificate matches the server's domain name (that is, the domain name accessed by the user). If the verification is successful, the communication continues. Otherwise, the communication ends.
  4. The server requests the client certificate, and the client sends the certificate and public key to the server.
  5. The server verifies the client certificate. If the verification is successful, the server continues the communication with the client. If the verification fails, the server disconnects from the client.
  6. The client randomly generates a symmetric encryption key, encrypts the key using the server's public key (the server's public key is obtained from the server's certificate in step 2), and sends the encrypted key to the server.
  7. Upon receiving the encrypted information from the client, the server decrypts the information with the private key of the server to obtain the symmetric encryption key.
  8. In the subsequent session, the client and server use the symmetric encryption key to communicate with each other, ensuring information security during the communication.